From 8479ef08f439ae01ac85a72959284820a979fa61 Mon Sep 17 00:00:00 2001
From: Peter van der Zee <github-public@qfox.nl>
Date: Tue, 1 Apr 2025 23:37:43 +0200
Subject: [PATCH] Add requirements to help pages

---
 src/commands/analytics/cmd-analytics.test.ts  | 50 +++++-----
 src/commands/analytics/cmd-analytics.ts       |  4 +
 src/commands/audit-log/cmd-audit-log.test.ts  | 44 +++++----
 src/commands/audit-log/cmd-audit-log.ts       |  4 +
 .../dependencies/cmd-dependencies.test.ts     | 30 +++---
 src/commands/dependencies/cmd-dependencies.ts |  4 +
 .../diff-scan/cmd-diff-scan-get.test.ts       | 46 +++++----
 src/commands/diff-scan/cmd-diff-scan-get.ts   |  4 +
 src/commands/login/cmd-login.test.ts          | 29 +++---
 src/commands/login/cmd-login.ts               |  3 +
 .../cmd-organization-list.test.ts             |  4 +
 .../organization/cmd-organization-list.ts     |  4 +
 .../cmd-organization-policy-license.test.ts   |  4 +
 .../cmd-organization-policy-license.ts        |  4 +
 .../cmd-organization-policy-security.test.ts  |  4 +
 .../cmd-organization-policy-security.ts       |  4 +
 .../package/cmd-package-score.test.ts         | 52 +++++-----
 src/commands/package/cmd-package-score.ts     |  8 +-
 .../package/cmd-package-shallow.test.ts       |  8 +-
 src/commands/package/cmd-package-shallow.ts   |  8 +-
 src/commands/repos/cmd-repos-create.test.ts   | 38 ++++----
 src/commands/repos/cmd-repos-create.ts        |  4 +
 src/commands/repos/cmd-repos-del.test.ts      | 22 +++--
 src/commands/repos/cmd-repos-del.ts           |  4 +
 src/commands/repos/cmd-repos-list.test.ts     | 40 ++++----
 src/commands/repos/cmd-repos-list.ts          |  4 +
 src/commands/repos/cmd-repos-update.test.ts   | 38 ++++----
 src/commands/repos/cmd-repos-update.ts        |  4 +
 src/commands/repos/cmd-repos-view.test.ts     | 28 +++---
 src/commands/repos/cmd-repos-view.ts          |  4 +
 src/commands/scan/cmd-scan-create.test.ts     | 80 +++++++--------
 src/commands/scan/cmd-scan-create.ts          |  4 +
 src/commands/scan/cmd-scan-del.test.ts        | 26 ++---
 src/commands/scan/cmd-scan-del.ts             |  4 +
 src/commands/scan/cmd-scan-list.test.ts       | 44 +++++----
 src/commands/scan/cmd-scan-list.ts            |  4 +
 src/commands/scan/cmd-scan-metadata.test.ts   | 26 ++---
 src/commands/scan/cmd-scan-metadata.ts        |  4 +
 src/commands/scan/cmd-scan-report.test.ts     | 51 +++++-----
 src/commands/scan/cmd-scan-report.ts          | 11 +--
 src/commands/scan/cmd-scan-view.test.ts       | 28 +++---
 src/commands/scan/cmd-scan-view.ts            |  4 +
 .../threat-feed/cmd-threat-feed.test.ts       | 97 ++++++++++---------
 src/commands/threat-feed/cmd-threat-feed.ts   |  5 +
 44 files changed, 519 insertions(+), 373 deletions(-)

diff --git a/src/commands/analytics/cmd-analytics.test.ts b/src/commands/analytics/cmd-analytics.test.ts
index d484e1c4f..6f0afa389 100644
--- a/src/commands/analytics/cmd-analytics.test.ts
+++ b/src/commands/analytics/cmd-analytics.test.ts
@@ -18,29 +18,33 @@ describe('socket analytics', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Look up analytics data
-
-        Usage
-          $ socket analytics --scope=<scope> --time=<time filter>
-
-        Default parameters are set to show the organization-level analytics over the
-        last 7 days.
-
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --file            Path to a local file to save the output. Only valid with --json/--markdown. Defaults to stdout.
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
-          --repo            Name of the repository. Only valid when scope=repo
-          --scope           Scope of the analytics data - either 'org' or 'repo', default: org
-          --time            Time filter - either 7, 30 or 90, default: 7
-
-        Examples
-          $ socket analytics --scope=org --time=7
-          $ socket analytics --scope=org --time=30
-          $ socket analytics --scope=repo --repo=test-repo --time=30"
-    `
+        "Look up analytics data
+
+          Usage
+            $ socket analytics --scope=<scope> --time=<time filter>
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: report:write
+
+          Default parameters are set to show the organization-level analytics over the
+          last 7 days.
+
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --file            Path to a local file to save the output. Only valid with --json/--markdown. Defaults to stdout.
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+            --repo            Name of the repository. Only valid when scope=repo
+            --scope           Scope of the analytics data - either 'org' or 'repo', default: org
+            --time            Time filter - either 7, 30 or 90, default: 7
+
+          Examples
+            $ socket analytics --scope=org --time=7
+            $ socket analytics --scope=org --time=30
+            $ socket analytics --scope=repo --repo=test-repo --time=30"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/analytics/cmd-analytics.ts b/src/commands/analytics/cmd-analytics.ts
index e70817774..026bb926c 100644
--- a/src/commands/analytics/cmd-analytics.ts
+++ b/src/commands/analytics/cmd-analytics.ts
@@ -52,6 +52,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} --scope=<scope> --time=<time filter>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: report:write
+
     Default parameters are set to show the organization-level analytics over the
     last 7 days.
 
diff --git a/src/commands/audit-log/cmd-audit-log.test.ts b/src/commands/audit-log/cmd-audit-log.test.ts
index 2db830b70..7d56f837e 100644
--- a/src/commands/audit-log/cmd-audit-log.test.ts
+++ b/src/commands/audit-log/cmd-audit-log.test.ts
@@ -18,26 +18,30 @@ describe('socket audit-log', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Look up the audit log for an organization
-
-        Usage
-          $ socket audit-log <org slug>
-
-        This feature requires an Enterprise Plan. To learn more about getting access
-        to this feature and many more, please visit https://socket.dev/pricing
-
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
-          --page            Page number - default is 1
-          --perPage         Results per page - default is 30
-          --type            Type of log event
-
-        Examples
-          $ socket audit-log FakeOrg"
-    `
+        "Look up the audit log for an organization
+
+          Usage
+            $ socket audit-log <org slug>
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: audit-log:list
+
+          This feature requires an Enterprise Plan. To learn more about getting access
+          to this feature and many more, please visit https://socket.dev/pricing
+
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+            --page            Page number - default is 1
+            --perPage         Results per page - default is 30
+            --type            Type of log event
+
+          Examples
+            $ socket audit-log FakeOrg"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/audit-log/cmd-audit-log.ts b/src/commands/audit-log/cmd-audit-log.ts
index a80225c67..689a130f5 100644
--- a/src/commands/audit-log/cmd-audit-log.ts
+++ b/src/commands/audit-log/cmd-audit-log.ts
@@ -43,6 +43,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: audit-log:list
+
     This feature requires an Enterprise Plan. To learn more about getting access
     to this feature and many more, please visit https://socket.dev/pricing
 
diff --git a/src/commands/dependencies/cmd-dependencies.test.ts b/src/commands/dependencies/cmd-dependencies.test.ts
index 2ae183e2c..2e95fc5ab 100644
--- a/src/commands/dependencies/cmd-dependencies.test.ts
+++ b/src/commands/dependencies/cmd-dependencies.test.ts
@@ -18,22 +18,26 @@ describe('socket dependencies', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Search for any dependency that is being used in your organization
+        "Search for any dependency that is being used in your organization
 
-        Usage
-          socket dependencies
+          Usage
+            socket dependencies
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --limit           Maximum number of dependencies returned
-          --markdown        Output result as markdown
-          --offset          Page number
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: none (does need token with access to target org)
 
-        Examples
-          socket dependencies --limit 20 --offset 10"
-    `
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --limit           Maximum number of dependencies returned
+            --markdown        Output result as markdown
+            --offset          Page number
+
+          Examples
+            socket dependencies --limit 20 --offset 10"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/dependencies/cmd-dependencies.ts b/src/commands/dependencies/cmd-dependencies.ts
index ff86de9c5..932d61cb6 100644
--- a/src/commands/dependencies/cmd-dependencies.ts
+++ b/src/commands/dependencies/cmd-dependencies.ts
@@ -37,6 +37,10 @@ const config: CliCommandConfig = {
     Usage
       ${command}
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: none (does need token with access to target org)
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/diff-scan/cmd-diff-scan-get.test.ts b/src/commands/diff-scan/cmd-diff-scan-get.test.ts
index c8704ca3f..a537667d0 100644
--- a/src/commands/diff-scan/cmd-diff-scan-get.test.ts
+++ b/src/commands/diff-scan/cmd-diff-scan-get.test.ts
@@ -18,27 +18,31 @@ describe('socket diff-scan get', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Get a diff scan for an organization
-
-        Usage
-          $ socket diff-scan get <org slug> --before=<before> --after=<after>
-
-        This command displays the package changes between two scans. The full output
-        can be pretty large depending on the size of your repo and time range. It is
-        best stored to disk to be further analyzed by other tools.
-
-        Options
-          --after           The scan ID of the head scan
-          --before          The scan ID of the base scan
-          --depth           Max depth of JSON to display before truncating, use zero for no limit (without --json/--file)
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --file            Path to a local file where the output should be saved. Use \`-\` to force stdout.
-          --help            Print this help.
-          --json            Output result as json. This can be big. Use --file to store it to disk without truncation.
-
-        Examples
-          $ socket diff-scan get FakeCorp --before=aaa0aa0a-aaaa-0000-0a0a-0000000a00a0 --after=aaa1aa1a-aaaa-1111-1a1a-1111111a11a1"
-    `
+        "Get a diff scan for an organization
+
+          Usage
+            $ socket diff-scan get <org slug> --before=<before> --after=<after>
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: full-scans:list
+
+          This command displays the package changes between two scans. The full output
+          can be pretty large depending on the size of your repo and time range. It is
+          best stored to disk to be further analyzed by other tools.
+
+          Options
+            --after           The scan ID of the head scan
+            --before          The scan ID of the base scan
+            --depth           Max depth of JSON to display before truncating, use zero for no limit (without --json/--file)
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --file            Path to a local file where the output should be saved. Use \`-\` to force stdout.
+            --help            Print this help.
+            --json            Output result as json. This can be big. Use --file to store it to disk without truncation.
+
+          Examples
+            $ socket diff-scan get FakeCorp --before=aaa0aa0a-aaaa-0000-0a0a-0000000a00a0 --after=aaa1aa1a-aaaa-1111-1a1a-1111111a11a1"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/diff-scan/cmd-diff-scan-get.ts b/src/commands/diff-scan/cmd-diff-scan-get.ts
index fc1772e2f..404cb6ca6 100644
--- a/src/commands/diff-scan/cmd-diff-scan-get.ts
+++ b/src/commands/diff-scan/cmd-diff-scan-get.ts
@@ -56,6 +56,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug> --before=<before> --after=<after>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: full-scans:list
+
     This command displays the package changes between two scans. The full output
     can be pretty large depending on the size of your repo and time range. It is
     best stored to disk to be further analyzed by other tools.
diff --git a/src/commands/login/cmd-login.test.ts b/src/commands/login/cmd-login.test.ts
index 7e0fa4534..4ce3fbe64 100644
--- a/src/commands/login/cmd-login.test.ts
+++ b/src/commands/login/cmd-login.test.ts
@@ -18,23 +18,26 @@ describe('socket login', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Socket API login
+        "Socket API login
 
-        Usage
-          $ socket login
+          Usage
+            $ socket login
 
-        Logs into the Socket API by prompting for an API key
+          API Token Requirements
+            - Quota: 1 unit
 
-        Options
-          --apiBaseUrl      API server to connect to for login
-          --apiProxy        Proxy to use when making connection to API server
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
+          Logs into the Socket API by prompting for an API key
 
-        Examples
-          $ socket login
-          $ socket login --api-proxy=http://localhost:1234"
-    `
+          Options
+            --apiBaseUrl      API server to connect to for login
+            --apiProxy        Proxy to use when making connection to API server
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+
+          Examples
+            $ socket login
+            $ socket login --api-proxy=http://localhost:1234"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/login/cmd-login.ts b/src/commands/login/cmd-login.ts
index 34cf0dc38..4871b15a7 100644
--- a/src/commands/login/cmd-login.ts
+++ b/src/commands/login/cmd-login.ts
@@ -31,6 +31,9 @@ const config: CliCommandConfig = {
     Usage
       $ ${command}
 
+    API Token Requirements
+      - Quota: 1 unit
+
     Logs into the Socket API by prompting for an API key
 
     Options
diff --git a/src/commands/organization/cmd-organization-list.test.ts b/src/commands/organization/cmd-organization-list.test.ts
index c325b18f0..7b4f51686 100644
--- a/src/commands/organization/cmd-organization-list.test.ts
+++ b/src/commands/organization/cmd-organization-list.test.ts
@@ -23,6 +23,10 @@ describe('socket organization list', async () => {
           Usage
             $ socket organization list
 
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: none (does need a token)
+
           Options
             --dryRun          Do input validation for a command and exit 0 when input is ok
             --help            Print this help.
diff --git a/src/commands/organization/cmd-organization-list.ts b/src/commands/organization/cmd-organization-list.ts
index 4120f9159..ad0d3b8bb 100644
--- a/src/commands/organization/cmd-organization-list.ts
+++ b/src/commands/organization/cmd-organization-list.ts
@@ -24,6 +24,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command}
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: none (does need a token)
+
     Options
       ${getFlagListOutput(config.flags, 6)}
   `
diff --git a/src/commands/organization/cmd-organization-policy-license.test.ts b/src/commands/organization/cmd-organization-policy-license.test.ts
index 3a7bc0c27..ee41c7329 100644
--- a/src/commands/organization/cmd-organization-policy-license.test.ts
+++ b/src/commands/organization/cmd-organization-policy-license.test.ts
@@ -23,6 +23,10 @@ describe('socket organization policy license', async () => {
           Usage
             $ socket organization policy license <org slug>
 
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: license-policy:read
+
           Options
             --dryRun          Do input validation for a command and exit 0 when input is ok
             --help            Print this help.
diff --git a/src/commands/organization/cmd-organization-policy-license.ts b/src/commands/organization/cmd-organization-policy-license.ts
index 5a009ebac..33a05cd97 100644
--- a/src/commands/organization/cmd-organization-policy-license.ts
+++ b/src/commands/organization/cmd-organization-policy-license.ts
@@ -26,6 +26,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: license-policy:read
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/organization/cmd-organization-policy-security.test.ts b/src/commands/organization/cmd-organization-policy-security.test.ts
index a9e2f8f1e..f1fa69e04 100644
--- a/src/commands/organization/cmd-organization-policy-security.test.ts
+++ b/src/commands/organization/cmd-organization-policy-security.test.ts
@@ -23,6 +23,10 @@ describe('socket organization policy security', async () => {
           Usage
             $ socket organization policy security <org slug>
 
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: security-policy:read
+
           Options
             --dryRun          Do input validation for a command and exit 0 when input is ok
             --help            Print this help.
diff --git a/src/commands/organization/cmd-organization-policy-security.ts b/src/commands/organization/cmd-organization-policy-security.ts
index 361485430..6aacff4fb 100644
--- a/src/commands/organization/cmd-organization-policy-security.ts
+++ b/src/commands/organization/cmd-organization-policy-security.ts
@@ -26,6 +26,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: security-policy:read
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/package/cmd-package-score.test.ts b/src/commands/package/cmd-package-score.test.ts
index ecac28387..20c1a82ac 100644
--- a/src/commands/package/cmd-package-score.test.ts
+++ b/src/commands/package/cmd-package-score.test.ts
@@ -18,42 +18,42 @@ describe('socket package score', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Look up score for one package which reflects all of its transitive dependencies as well
+        "Look up score for one package which reflects all of its transitive dependencies as well
 
-        Usage
-          $ socket package score <<ecosystem> <name> | <purl>>
+          Usage
+            $ socket package score <<ecosystem> <name> | <purl>>
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
+          API Token Requirements
+            - Quota: 100 units
+            - Permissions: packages:list
 
-        Requirements
-          - quota: 100
-          - scope: \`packages:list\`
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
 
-        Show deep scoring details for one package. The score will reflect the package
-        itself, any of its dependencies, and any of its transitive dependencies.
+          Show deep scoring details for one package. The score will reflect the package
+          itself, any of its dependencies, and any of its transitive dependencies.
 
-        When you want to know whether to trust a package, this is the command to run.
+          When you want to know whether to trust a package, this is the command to run.
 
-        See also the \`socket package shallow\` command, which returns the shallow
-        score for any number of packages. That will not reflect the dependency scores.
+          See also the \`socket package shallow\` command, which returns the shallow
+          score for any number of packages. That will not reflect the dependency scores.
 
-        Only a few ecosystems are supported like npm, golang, and maven.
+          Only a few ecosystems are supported like npm, golang, and maven.
 
-        A "purl" is a standard package name formatting: \`pkg:eco/name@version\`
-        This command will automatically prepend "pkg:" when not present.
+          A "purl" is a standard package name formatting: \`pkg:eco/name@version\`
+          This command will automatically prepend "pkg:" when not present.
 
-        The version is optional but when given should be a direct match.
+          The version is optional but when given should be a direct match.
 
-        Examples
-          $ socket package score npm babel-cli
-          $ socket package score npm babel-cli@1.9.1
-          $ socket package score npm/babel-cli@1.9.1
-          $ socket package score pkg:npm/babel-cli@1.9.1"
-    `
+          Examples
+            $ socket package score npm babel-cli
+            $ socket package score npm babel-cli@1.9.1
+            $ socket package score npm/babel-cli@1.9.1
+            $ socket package score pkg:npm/babel-cli@1.9.1"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
         "
diff --git a/src/commands/package/cmd-package-score.ts b/src/commands/package/cmd-package-score.ts
index e94e7af66..e05423081 100644
--- a/src/commands/package/cmd-package-score.ts
+++ b/src/commands/package/cmd-package-score.ts
@@ -26,13 +26,13 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <<ecosystem> <name> | <purl>>
 
+    API Token Requirements
+      - Quota: 100 units
+      - Permissions: packages:list
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
-    Requirements
-      - quota: 100
-      - scope: \`packages:list\`
-
     Show deep scoring details for one package. The score will reflect the package
     itself, any of its dependencies, and any of its transitive dependencies.
 
diff --git a/src/commands/package/cmd-package-shallow.test.ts b/src/commands/package/cmd-package-shallow.test.ts
index c8c07a9eb..7afca8cdf 100644
--- a/src/commands/package/cmd-package-shallow.test.ts
+++ b/src/commands/package/cmd-package-shallow.test.ts
@@ -23,16 +23,16 @@ describe('socket package shallow', async () => {
           Usage
             $ socket package shallow <<ecosystem> <name> [<name> ...] | <purl> [<purl> ...]>
 
+          API Token Requirements
+            - Quota: 100 units
+            - Permissions: packages:list
+
           Options
             --dryRun          Do input validation for a command and exit 0 when input is ok
             --help            Print this help.
             --json            Output result as json
             --markdown        Output result as markdown
 
-          Requirements
-            - quota: 100
-            - scope: \`packages:list\`
-
           Show scoring details for one or more packages purely based on their own package.
           This means that any dependency scores are not reflected by the score. You can
           use the \`socket package score <pkg>\` command to get its full transitive score.
diff --git a/src/commands/package/cmd-package-shallow.ts b/src/commands/package/cmd-package-shallow.ts
index bf4392ea5..7d03f1f1d 100644
--- a/src/commands/package/cmd-package-shallow.ts
+++ b/src/commands/package/cmd-package-shallow.ts
@@ -25,13 +25,13 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <<ecosystem> <name> [<name> ...] | <purl> [<purl> ...]>
 
+    API Token Requirements
+      - Quota: 100 units
+      - Permissions: packages:list
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
-    Requirements
-      - quota: 100
-      - scope: \`packages:list\`
-
     Show scoring details for one or more packages purely based on their own package.
     This means that any dependency scores are not reflected by the score. You can
     use the \`socket package score <pkg>\` command to get its full transitive score.
diff --git a/src/commands/repos/cmd-repos-create.test.ts b/src/commands/repos/cmd-repos-create.test.ts
index d2cee262a..5df8ccdc6 100644
--- a/src/commands/repos/cmd-repos-create.test.ts
+++ b/src/commands/repos/cmd-repos-create.test.ts
@@ -18,23 +18,27 @@ describe('socket repos create', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Create a repository in an organization
-
-        Usage
-          $ socket repos create <org slug>
-
-        Options
-          --defaultBranch   Repository default branch
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --homepage        Repository url
-          --repoDescription Repository description
-          --repoName        Repository name
-          --visibility      Repository visibility (Default Private)
-
-        Examples
-          $ socket repos create FakeOrg --repoName=test-repo"
-    `
+        "Create a repository in an organization
+
+          Usage
+            $ socket repos create <org slug>
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: repo:create
+
+          Options
+            --defaultBranch   Repository default branch
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --homepage        Repository url
+            --repoDescription Repository description
+            --repoName        Repository name
+            --visibility      Repository visibility (Default Private)
+
+          Examples
+            $ socket repos create FakeOrg --repoName=test-repo"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/repos/cmd-repos-create.ts b/src/commands/repos/cmd-repos-create.ts
index f8d121dd6..85fb5e031 100644
--- a/src/commands/repos/cmd-repos-create.ts
+++ b/src/commands/repos/cmd-repos-create.ts
@@ -54,6 +54,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: repo:create
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/repos/cmd-repos-del.test.ts b/src/commands/repos/cmd-repos-del.test.ts
index 65d0941b8..9217c2bef 100644
--- a/src/commands/repos/cmd-repos-del.test.ts
+++ b/src/commands/repos/cmd-repos-del.test.ts
@@ -18,18 +18,22 @@ describe('socket repos del', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Delete a repository in an organization
+        "Delete a repository in an organization
 
-        Usage
-          $ socket repos del <org slug> <repo slug>
+          Usage
+            $ socket repos del <org slug> <repo slug>
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: repo:delete
 
-        Examples
-          $ socket repos del FakeOrg test-repo"
-    `
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+
+          Examples
+            $ socket repos del FakeOrg test-repo"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/repos/cmd-repos-del.ts b/src/commands/repos/cmd-repos-del.ts
index 0df2cf8dc..5faff6afa 100644
--- a/src/commands/repos/cmd-repos-del.ts
+++ b/src/commands/repos/cmd-repos-del.ts
@@ -24,6 +24,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug> <repo slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: repo:delete
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/repos/cmd-repos-list.test.ts b/src/commands/repos/cmd-repos-list.test.ts
index ce2813a0f..c26e7d1de 100644
--- a/src/commands/repos/cmd-repos-list.test.ts
+++ b/src/commands/repos/cmd-repos-list.test.ts
@@ -18,24 +18,28 @@ describe('socket repos list', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "List repositories in an organization
-
-        Usage
-          $ socket repos list <org slug>
-
-        Options
-          --direction       Direction option
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
-          --page            Page number
-          --perPage         Number of results per page
-          --sort            Sorting option
-
-        Examples
-          $ socket repos list FakeOrg"
-    `
+        "List repositories in an organization
+
+          Usage
+            $ socket repos list <org slug>
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: repo:list
+
+          Options
+            --direction       Direction option
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+            --page            Page number
+            --perPage         Number of results per page
+            --sort            Sorting option
+
+          Examples
+            $ socket repos list FakeOrg"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/repos/cmd-repos-list.ts b/src/commands/repos/cmd-repos-list.ts
index 6937ba5c2..070fccaf9 100644
--- a/src/commands/repos/cmd-repos-list.ts
+++ b/src/commands/repos/cmd-repos-list.ts
@@ -48,6 +48,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: repo:list
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/repos/cmd-repos-update.test.ts b/src/commands/repos/cmd-repos-update.test.ts
index 73aa83d6b..fef78d1c3 100644
--- a/src/commands/repos/cmd-repos-update.test.ts
+++ b/src/commands/repos/cmd-repos-update.test.ts
@@ -18,23 +18,27 @@ describe('socket repos update', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Update a repository in an organization
-
-        Usage
-          $ socket repos update <org slug>
-
-        Options
-          --defaultBranch   Repository default branch
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --homepage        Repository url
-          --repoDescription Repository description
-          --repoName        Repository name
-          --visibility      Repository visibility (Default Private)
-
-        Examples
-          $ socket repos update FakeOrg"
-    `
+        "Update a repository in an organization
+
+          Usage
+            $ socket repos update <org slug>
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: repo:update
+
+          Options
+            --defaultBranch   Repository default branch
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --homepage        Repository url
+            --repoDescription Repository description
+            --repoName        Repository name
+            --visibility      Repository visibility (Default Private)
+
+          Examples
+            $ socket repos update FakeOrg"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/repos/cmd-repos-update.ts b/src/commands/repos/cmd-repos-update.ts
index b0b1c2a48..757148957 100644
--- a/src/commands/repos/cmd-repos-update.ts
+++ b/src/commands/repos/cmd-repos-update.ts
@@ -54,6 +54,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: repo:update
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/repos/cmd-repos-view.test.ts b/src/commands/repos/cmd-repos-view.test.ts
index 268ad6755..784ae2a50 100644
--- a/src/commands/repos/cmd-repos-view.test.ts
+++ b/src/commands/repos/cmd-repos-view.test.ts
@@ -18,21 +18,25 @@ describe('socket repos view', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "View repositories in an organization
+        "View repositories in an organization
 
-        Usage
-          $ socket repos view <org slug>
+          Usage
+            $ socket repos view <org slug>
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
-          --repoName        The repository to check
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: repo:list
 
-        Examples
-          $ socket repos view FakeOrg"
-    `
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+            --repoName        The repository to check
+
+          Examples
+            $ socket repos view FakeOrg"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/repos/cmd-repos-view.ts b/src/commands/repos/cmd-repos-view.ts
index bb0377505..48fa8d9a6 100644
--- a/src/commands/repos/cmd-repos-view.ts
+++ b/src/commands/repos/cmd-repos-view.ts
@@ -30,6 +30,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: repo:list
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/scan/cmd-scan-create.test.ts b/src/commands/scan/cmd-scan-create.test.ts
index 739565c46..7ddb75283 100644
--- a/src/commands/scan/cmd-scan-create.test.ts
+++ b/src/commands/scan/cmd-scan-create.test.ts
@@ -17,44 +17,48 @@ describe('socket scan create', async () => {
     async cmd => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(`
-      "Create a scan
-
-        Usage
-          $ socket scan create [...options] <org> <TARGET> [TARGET...]
-
-        Uploads the specified "package.json" and lock files for JavaScript, Python,
-        Go, Scala, Gradle, and Kotlin dependency manifests.
-        If any folder is specified, the ones found in there recursively are uploaded.
-
-        Supports globbing such as "**/package.json", "**/requirements.txt", etc.
-
-        Ignores any file specified in your project's ".gitignore" and also has a
-        sensible set of default ignores from the "ignore-by-default" module.
-
-        TARGET should be a FILE or DIR that _must_ be inside the CWD.
-
-        When a FILE is given only that FILE is targeted. Otherwise any eligible
-        files in the given DIR will be considered.
-
-        Options
-          --branch          Branch name
-          --commitHash      Commit hash
-          --commitMessage   Commit message
-          --committers      Committers
-          --cwd             working directory, defaults to process.cwd()
-          --defaultBranch   Make default branch
-          --dryRun          run input validation part of command without any concrete side effects
-          --help            Print this help.
-          --pendingHead     Set as pending head
-          --pullRequest     Commit hash
-          --readOnly        Similar to --dry-run except it can read from remote, stops before it would create an actual report
-          --repo            Repository name
-          --tmp             Set the visibility (true/false) of the scan in your dashboard
-          --view            Will wait for and return the created report. Use --no-view to disable.
-
-        Examples
-          $ socket scan create --repo=test-repo --branch=main FakeOrg ./package.json"
-    `)
+        "Create a scan
+
+          Usage
+            $ socket scan create [...options] <org> <TARGET> [TARGET...]
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: full-scans:create
+
+          Uploads the specified "package.json" and lock files for JavaScript, Python,
+          Go, Scala, Gradle, and Kotlin dependency manifests.
+          If any folder is specified, the ones found in there recursively are uploaded.
+
+          Supports globbing such as "**/package.json", "**/requirements.txt", etc.
+
+          Ignores any file specified in your project's ".gitignore" and also has a
+          sensible set of default ignores from the "ignore-by-default" module.
+
+          TARGET should be a FILE or DIR that _must_ be inside the CWD.
+
+          When a FILE is given only that FILE is targeted. Otherwise any eligible
+          files in the given DIR will be considered.
+
+          Options
+            --branch          Branch name
+            --commitHash      Commit hash
+            --commitMessage   Commit message
+            --committers      Committers
+            --cwd             working directory, defaults to process.cwd()
+            --defaultBranch   Make default branch
+            --dryRun          run input validation part of command without any concrete side effects
+            --help            Print this help.
+            --pendingHead     Set as pending head
+            --pullRequest     Commit hash
+            --readOnly        Similar to --dry-run except it can read from remote, stops before it would create an actual report
+            --repo            Repository name
+            --tmp             Set the visibility (true/false) of the scan in your dashboard
+            --view            Will wait for and return the created report. Use --no-view to disable.
+
+          Examples
+            $ socket scan create --repo=test-repo --branch=main FakeOrg ./package.json"
+      `)
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
          _____         _       _        /---------------
diff --git a/src/commands/scan/cmd-scan-create.ts b/src/commands/scan/cmd-scan-create.ts
index d2cc02807..acffc18e4 100644
--- a/src/commands/scan/cmd-scan-create.ts
+++ b/src/commands/scan/cmd-scan-create.ts
@@ -105,6 +105,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} [...options] <org> <TARGET> [TARGET...]
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: full-scans:create
+
     Uploads the specified "package.json" and lock files for JavaScript, Python,
     Go, Scala, Gradle, and Kotlin dependency manifests.
     If any folder is specified, the ones found in there recursively are uploaded.
diff --git a/src/commands/scan/cmd-scan-del.test.ts b/src/commands/scan/cmd-scan-del.test.ts
index 85509ec9a..2c409ea5b 100644
--- a/src/commands/scan/cmd-scan-del.test.ts
+++ b/src/commands/scan/cmd-scan-del.test.ts
@@ -18,20 +18,24 @@ describe('socket scan del', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Delete a scan
+        "Delete a scan
 
-        Usage
-          $ socket scan del <org slug> <scan ID>
+          Usage
+            $ socket scan del <org slug> <scan ID>
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: full-scans:delete
 
-        Examples
-          $ socket scan del FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0"
-    `
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+
+          Examples
+            $ socket scan del FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/scan/cmd-scan-del.ts b/src/commands/scan/cmd-scan-del.ts
index 66d20521d..ee91adb95 100644
--- a/src/commands/scan/cmd-scan-del.ts
+++ b/src/commands/scan/cmd-scan-del.ts
@@ -25,6 +25,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug> <scan ID>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: full-scans:delete
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/scan/cmd-scan-list.test.ts b/src/commands/scan/cmd-scan-list.test.ts
index ae1686f4b..a0e37ed78 100644
--- a/src/commands/scan/cmd-scan-list.test.ts
+++ b/src/commands/scan/cmd-scan-list.test.ts
@@ -18,26 +18,30 @@ describe('socket scan list', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "List the scans for an organization
-
-        Usage
-          $ socket scan list <org slug>
-
-        Options
-          --direction       Direction option (\`desc\` or \`asc\`) - Default is \`desc\`
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --fromTime        From time - as a unix timestamp
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
-          --page            Page number - Default is 1
-          --perPage         Results per page - Default is 30
-          --sort            Sorting option (\`name\` or \`created_at\`) - default is \`created_at\`
-          --untilTime       Until time - as a unix timestamp
-
-        Examples
-          $ socket scan list FakeOrg"
-    `
+        "List the scans for an organization
+
+          Usage
+            $ socket scan list <org slug>
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: full-scans:list
+
+          Options
+            --direction       Direction option (\`desc\` or \`asc\`) - Default is \`desc\`
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --fromTime        From time - as a unix timestamp
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+            --page            Page number - Default is 1
+            --perPage         Results per page - Default is 30
+            --sort            Sorting option (\`name\` or \`created_at\`) - default is \`created_at\`
+            --untilTime       Until time - as a unix timestamp
+
+          Examples
+            $ socket scan list FakeOrg"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/scan/cmd-scan-list.ts b/src/commands/scan/cmd-scan-list.ts
index 0f5fcf7b0..2f35c643f 100644
--- a/src/commands/scan/cmd-scan-list.ts
+++ b/src/commands/scan/cmd-scan-list.ts
@@ -65,6 +65,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: full-scans:list
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/scan/cmd-scan-metadata.test.ts b/src/commands/scan/cmd-scan-metadata.test.ts
index 0dbf74cc0..b0277ccad 100644
--- a/src/commands/scan/cmd-scan-metadata.test.ts
+++ b/src/commands/scan/cmd-scan-metadata.test.ts
@@ -18,20 +18,24 @@ describe('socket scan metadata', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Get a scan's metadata
+        "Get a scan's metadata
 
-        Usage
-          $ socket scan metadata <org slug> <scan id>
+          Usage
+            $ socket scan metadata <org slug> <scan id>
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: full-scans:list
 
-        Examples
-          $ socket scan metadata FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0"
-    `
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+
+          Examples
+            $ socket scan metadata FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/scan/cmd-scan-metadata.ts b/src/commands/scan/cmd-scan-metadata.ts
index 13c109ecf..6a291d458 100644
--- a/src/commands/scan/cmd-scan-metadata.ts
+++ b/src/commands/scan/cmd-scan-metadata.ts
@@ -28,6 +28,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug> <scan id>
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: full-scans:list
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
diff --git a/src/commands/scan/cmd-scan-report.test.ts b/src/commands/scan/cmd-scan-report.test.ts
index 52b57184d..c8439d9bc 100644
--- a/src/commands/scan/cmd-scan-report.test.ts
+++ b/src/commands/scan/cmd-scan-report.test.ts
@@ -18,40 +18,37 @@ describe('socket scan report', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "Check whether a scan result passes the organizational policies (security, license)
+        "Check whether a scan result passes the organizational policies (security, license)
 
-        Usage
-          $ socket scan report <org slug> <scan ID> [path to output file]
+          Usage
+            $ socket scan report <org slug> <scan ID> [path to output file]
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --fold            Fold reported alerts to some degree
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
-          --reportLevel     Which policy level alerts should be reported
-          --security        Report the security policy status. Default: true
-          --short           Report only the healthy status
+          API Token Requirements
+            - Quota: 3 units
+            - Permissions: full-scans:list security-policy:read
 
-        This consumes 1 quota unit plus 1 for each of the requested policy types.
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --fold            Fold reported alerts to some degree
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+            --reportLevel     Which policy level alerts should be reported
+            --security        Report the security policy status. Default: true
+            --short           Report only the healthy status
 
-        Note: By default it reports both so by default it consumes 3 quota units.
+          By default the result is a nested object that looks like this:
+            \`{[ecosystem]: {[pkgName]: {[version]: {[file]: {[type:loc]: policy}}}}\`
+          You can fold this up to given level: 'pkg', 'version', 'file', and 'none'.
 
-        Your API token will need the \`full-scans:list\` scope regardless. Additionally
-        it needs \`security-policy:read\` to report on the security policy.
+          By default only the warn and error policy level alerts are reported. You can
+          override this and request more ('defer' < 'ignore' < 'monitor' < 'warn' < 'error')
 
-        By default the result is a nested object that looks like this:
-          \`{[ecosystem]: {[pkgName]: {[version]: {[file]: {[type:loc]: policy}}}}\`
-        You can fold this up to given level: 'pkg', 'version', 'file', and 'none'.
+          Short responses: JSON: \`{healthy:bool}\`, markdown: \`healthy = bool\`, text: \`OK/ERR\`
 
-        By default only the warn and error policy level alerts are reported. You can
-        override this and request more ('defer' < 'ignore' < 'monitor' < 'warn' < 'error')
-
-        Short responses: JSON: \`{healthy:bool}\`, markdown: \`healthy = bool\`, text: \`OK/ERR\`
-
-        Examples
-          $ socket scan report FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0 --json --fold=version"
-    `
+          Examples
+            $ socket scan report FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0 --json --fold=version"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/scan/cmd-scan-report.ts b/src/commands/scan/cmd-scan-report.ts
index a61607857..a84854ef3 100644
--- a/src/commands/scan/cmd-scan-report.ts
+++ b/src/commands/scan/cmd-scan-report.ts
@@ -54,16 +54,13 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug> <scan ID> [path to output file]
 
+    API Token Requirements
+      - Quota: 3 units
+      - Permissions: full-scans:list security-policy:read
+
     Options
       ${getFlagListOutput(config.flags, 6)}
 
-    This consumes 1 quota unit plus 1 for each of the requested policy types.
-
-    Note: By default it reports both so by default it consumes 3 quota units.
-
-    Your API token will need the \`full-scans:list\` scope regardless. Additionally
-    it needs \`security-policy:read\` to report on the security policy.
-
     By default the result is a nested object that looks like this:
       \`{[ecosystem]: {[pkgName]: {[version]: {[file]: {[type:loc]: policy}}}}\`
     You can fold this up to given level: 'pkg', 'version', 'file', and 'none'.
diff --git a/src/commands/scan/cmd-scan-view.test.ts b/src/commands/scan/cmd-scan-view.test.ts
index 73627ad09..ebf9fc0fd 100644
--- a/src/commands/scan/cmd-scan-view.test.ts
+++ b/src/commands/scan/cmd-scan-view.test.ts
@@ -18,22 +18,26 @@ describe('socket scan view', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "View the raw results of a scan
+        "View the raw results of a scan
 
-        Usage
-          $ socket scan view <org slug> <scan ID> [path to output file]
+          Usage
+            $ socket scan view <org slug> <scan ID> [path to output file]
 
-        When no output path is given the contents is sent to stdout.
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: full-scans:list
 
-        Options
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
+          When no output path is given the contents is sent to stdout.
 
-        Examples
-          $ socket scan view FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0 ./stream.txt"
-    `
+          Options
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+
+          Examples
+            $ socket scan view FakeOrg 000aaaa1-0000-0a0a-00a0-00a0000000a0 ./stream.txt"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/scan/cmd-scan-view.ts b/src/commands/scan/cmd-scan-view.ts
index db3d5ff59..d1b4c9dc8 100644
--- a/src/commands/scan/cmd-scan-view.ts
+++ b/src/commands/scan/cmd-scan-view.ts
@@ -29,6 +29,10 @@ const config: CliCommandConfig = {
     Usage
       $ ${command} <org slug> <scan ID> [path to output file]
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: full-scans:list
+
     When no output path is given the contents is sent to stdout.
 
     Options
diff --git a/src/commands/threat-feed/cmd-threat-feed.test.ts b/src/commands/threat-feed/cmd-threat-feed.test.ts
index 636fb4273..97caeaf8a 100644
--- a/src/commands/threat-feed/cmd-threat-feed.test.ts
+++ b/src/commands/threat-feed/cmd-threat-feed.test.ts
@@ -18,52 +18,57 @@ describe('socket threat-feed', async () => {
       const { code, stderr, stdout } = await invokeNpm(entryPath, cmd)
       expect(stdout).toMatchInlineSnapshot(
         `
-      "[beta] View the threat feed
-
-        Usage
-          $ socket threat-feed
-
-        This feature requires a Threat Feed license. Please contact
-        sales@socket.dev if you are interested in purchasing this access.
-
-        Options
-          --direction       Order asc or desc by the createdAt attribute.
-          --dryRun          Do input validation for a command and exit 0 when input is ok
-          --eco             Only show threats for a particular ecosystem
-          --filter          Filter what type of threats to return
-          --help            Print this help.
-          --json            Output result as json
-          --markdown        Output result as markdown
-          --page            Page token
-          --perPage         Number of items per page
-
-        Valid filters:
-
-          - anom    Anomaly
-          - c       Do not filter
-          - fp      False Positives
-          - joke    Joke / Fake
-          - mal     Malware and Possible Malware [default]
-          - secret  Secrets
-          - spy     Telemetry
-          - tp      False Positives and Unreviewed
-          - typo    Typo-squat
-          - u       Unreviewed
-          - vuln    Vulnerability
-
-        Valid ecosystems:
-
-          - gem
-          - golang
-          - maven
-          - npm
-          - nuget
-          - pypi
-
-        Examples
-          $ socket threat-feed
-          $ socket threat-feed --perPage=5 --page=2 --direction=asc --filter=joke"
-    `
+        "[beta] View the threat feed
+
+          Usage
+            $ socket threat-feed
+
+          API Token Requirements
+            - Quota: 1 unit
+            - Permissions: threat-feed:list
+            - Special access
+
+          This feature requires a Threat Feed license. Please contact
+          sales@socket.dev if you are interested in purchasing this access.
+
+          Options
+            --direction       Order asc or desc by the createdAt attribute.
+            --dryRun          Do input validation for a command and exit 0 when input is ok
+            --eco             Only show threats for a particular ecosystem
+            --filter          Filter what type of threats to return
+            --help            Print this help.
+            --json            Output result as json
+            --markdown        Output result as markdown
+            --page            Page token
+            --perPage         Number of items per page
+
+          Valid filters:
+
+            - anom    Anomaly
+            - c       Do not filter
+            - fp      False Positives
+            - joke    Joke / Fake
+            - mal     Malware and Possible Malware [default]
+            - secret  Secrets
+            - spy     Telemetry
+            - tp      False Positives and Unreviewed
+            - typo    Typo-squat
+            - u       Unreviewed
+            - vuln    Vulnerability
+
+          Valid ecosystems:
+
+            - gem
+            - golang
+            - maven
+            - npm
+            - nuget
+            - pypi
+
+          Examples
+            $ socket threat-feed
+            $ socket threat-feed --perPage=5 --page=2 --direction=asc --filter=joke"
+      `
       )
       expect(`\n   ${stderr}`).toMatchInlineSnapshot(`
       "
diff --git a/src/commands/threat-feed/cmd-threat-feed.ts b/src/commands/threat-feed/cmd-threat-feed.ts
index a253e9265..6beef6a63 100644
--- a/src/commands/threat-feed/cmd-threat-feed.ts
+++ b/src/commands/threat-feed/cmd-threat-feed.ts
@@ -55,6 +55,11 @@ const config: CliCommandConfig = {
     Usage
       $ ${command}
 
+    API Token Requirements
+      - Quota: 1 unit
+      - Permissions: threat-feed:list
+      - Special access
+
     This feature requires a Threat Feed license. Please contact
     sales@socket.dev if you are interested in purchasing this access.