How scopes work
Scope names follow aresource:action format (e.g. devices:read).
Nearly all API endpoints require one or more scopes, shown on the endpoint’s API Reference page. If an API key is missing a required scope, the request returns 403 Forbidden.
Scope tiers
Most resources follow a common tier pattern:
The
write scope does not include read access—if you need both, select both scopes.
Some resources have additional granular scopes beyond the standard tiers (e.g. deployments:stage). The manage scope always includes everything for the resource.