Documentation
Sign In

API Scopes

Scopes restrict what an API key can do. Each scope follows the resource:operation pattern. Grant keys the narrowest set of scopes that covers their job.

How scope checks work

  • A :write scope implicitly includes the matching :read scope.
  • The special scope * grants full access to every resource.
  • A key created with no scopes also has full access (legacy behavior) — prefer always assigning explicit scopes.
  • Requests that fail a scope check return 403 with { "error": "Missing required scope: <scope>" }.

Available scopes

This list is rendered directly from the platform's scope registry, so it always matches what the API enforces.

Companies

companies:readView companies and their details
companies:writeCreate, update, and delete companies

Contacts

contacts:readView contacts and their details
contacts:writeCreate, update, and delete contacts

Deals

deals:readView deals and pipeline data
deals:writeCreate, update, and delete deals

Tasks

tasks:readView tasks
tasks:writeCreate, update, and delete tasks

Notes

notes:readView notes
notes:writeCreate, update, and delete notes

Invoices

invoices:readView invoices
invoices:writeCreate, update, and delete invoices

Deliverables

deliverables:readView deliverables
deliverables:writeCreate, update, and delete deliverables

Time Entries

time-entries:readView time entries
time-entries:writeCreate, update, and delete time entries

Bookkeeping

bookkeeping:readView bookkeeping transactions and reports
bookkeeping:writeCreate, update, and delete bookkeeping transactions

Commissions

commissions:readView commission rules, entries, and reports
commissions:writeManage commission rules and update entry statuses

Marketing

marketing:readView marketing opportunities, drafts, and campaigns
marketing:writeCreate and manage marketing opportunities, drafts, and campaigns

Professional Services

professional-services:readView the service catalog, templates, documents, and change orders
professional-services:writeCreate and manage services, templates, documents, and change orders

Saved Views

saved-views:readView saved views
saved-views:writeCreate, update, and delete saved views

Other

analytics:readView analytics and reports
activity:readView activity feed
search:readSearch across all accessible resources
users:readView organization users
organization:readView organization details

Choosing scopes

A reporting integration usually needs only :read scopes plus analytics:read. A two-way sync needs :write on exactly the resources it syncs. Avoid * outside of short-lived internal tooling — see security best practices.