# Scopes & permissions

> Coarse and resource scopes, admin-gated grants, and least-privilege keys.

Product: Clad API
Source: https://docs.useclad.ai/api/scopes

---

Every API key carries a set of scopes. A field runs only if the key holds a
scope that satisfies it. Requests missing a scope fail with `FORBIDDEN`.

Scopes come in two forms:

- **Coarse:** `read`, `write`, `admin`. `read` satisfies any `*:read` scope;
  `write` satisfies any non-admin `*:write` scope; `admin` satisfies everything
  in the schema.
- **Resource:** fine-grained `resource:action` grants for least-privilege keys.

Common resource scopes:

| Scope | Grants |
| --- | --- |
| `issues:read` | Read issues and their messages |
| `issues:write` | Create and mutate issues (status, priority, tags, assignment) |
| `issues:create` | Create-only intake (open an issue; cannot list or mutate others) |
| `thread:reply` | Reply to issue threads |
| `spam:write` | Mark issues as spam |
| `accounts:read` / `accounts:write` | Read / write CRM accounts |
| `contacts:read` / `contacts:write` | Read / write CRM contacts |
| `articles:read` / `articles:write` | Read / write knowledge-base articles |
| `articles:publish` | Publish articles with public visibility |
| `collections:write` | Manage KB collections |
| `tags:write` | Manage workspace tags |
| `views:read` / `views:write` | Read / write saved account views |
| `members:read` | Read org members |
| `teams:write` | Manage teams and team membership |
| `settings:read` / `settings:write` | Read / write workspace settings |
| `sla:read` | Read SLA policies and support-hours schedules |
| `customfields:write` | Manage account/contact custom fields |
| `widget:write` | Manage web widgets and widget forms |
| `webhooks:manage` | Manage webhook endpoints |
| `apikeys:read` / `apikeys:revoke` | Read key metadata / revoke keys |

Some scopes are **admin-gated** (`settings:write`, `customfields:write`,
`webhooks:manage`, `apikeys:read`, `apikeys:revoke`): a coarse `write` does not
satisfy them — the key needs the exact scope or `admin`.

Grant each key the narrowest set of scopes it needs.