Required scopes for Datadog application tokens?

[mwarkentin]

I'd like to scope my argo rollouts application token down to the minimum required permissions, but I'm unable to find any docs on what scopes are required. I tried using just metrics: read however I was getting 403 errors (could've been a different issue though, I'm just starting to use Datadog Analysis Templates).

Does anyone have a set of scopes? If so it would probably be good to add to the Datadog documentation as well.

Ref: https://docs.datadoghq.com/api/latest/scopes/