Scopes & permissions

Every API key carries a set of scopes. A field runs only if the key holds a scope that satisfies it. Requests missing a scope fail with FORBIDDEN.

Scopes come in two forms:

• Coarse: read, write, admin. read satisfies any *:read scope; write satisfies any non-admin *:write scope; admin satisfies everything in the schema.
• Resource: fine-grained resource:action grants for least-privilege keys.

Common resource scopes:

Scope	Grants
issues:read	Read issues and their messages
issues:write	Create and mutate issues (status, priority, tags, assignment)
issues:create	Create-only intake (open an issue; cannot list or mutate others)
thread:reply	Reply to issue threads
spam:write	Mark issues as spam
accounts:read / accounts:write	Read / write CRM accounts
contacts:read / contacts:write	Read / write CRM contacts
articles:read / articles:write	Read / write knowledge-base articles
articles:publish	Publish articles with public visibility
collections:write	Manage KB collections
tags:write	Manage workspace tags
views:read / views:write	Read / write saved account views
members:read	Read org members
teams:write	Manage teams and team membership
settings:read / settings:write	Read / write workspace settings
sla:read	Read SLA policies and support-hours schedules
customfields:write	Manage account/contact custom fields
widget:write	Manage web widgets and widget forms
webhooks:manage	Manage webhook endpoints
apikeys:read / apikeys:revoke	Read key metadata / revoke keys

Some scopes are admin-gated (settings:write, customfields:write, webhooks:manage, apikeys:read, apikeys:revoke): a coarse write does not satisfy them — the key needs the exact scope or admin.

Grant each key the narrowest set of scopes it needs.