Scopes describe what an OAuth2 access token or Personal Access Token is allowed to do, and are declared on a route using the #[scopeset] attribute. This page describes how to define the scope classes that make up that catalogue in the first place.
API routes are protected by Moodle's normal login and capability checks, but when a request is authenticated with an OAuth2 access token, or a Personal Access Token, the router also enforces Scopes. A scope is a small, named permission (for example core_userread) that describes what a particular token is allowed to do.