Key scopes, and how they combine with permissions

A scope is the name of an action on a unit, such as read.contacts. It decides which endpoints the key reaches. The records it sees are decided by the level of the member who created the key, on every request.

The 5 verbs

Levels on the create screen

The All units row takes None, Read, Write or Full, and produces wildcard scopes such as read.*, which cover every unit the creator can reach, now and later. Add specific object adds one unit with its own level (Read, Write or Full, starting at Write). You can also type any scope, such as read.contacts, in the Scopes field and press Enter.

The double check

The scope only gates the endpoints. After it, every record is checked against the creator’s current level. A key with the read.contacts scope, created by a member whose level is “If responsible”, sees only their records. If the member’s level is lowered later, what the key sees is lowered straight away.

A key never goes past its scopes, even if the owner created it. But a key from the owner or a super admin sees all records in the units within its scopes. Create keys from a member with the fewest permissions when the difference matters to you.

Assigning

Changing the assignee needs assign specifically. update isn’t enough, and the update.* wildcard doesn’t produce assign. The creator also needs the permission to assign and to edit that record.

If something goes wrong

Good to know