Scopes

Management API keys are denied by default. A route requires both the matching scope and, when the route targets an application, access to that application.

Dashboard sessions bypass scope checks because the session belongs to the account owner. Management API keys never bypass scope or application-access checks.

Scope	Allows
`applications:read`	List applications and read application settings.
`applications:create`	Create applications. Requires all-application access.
`applications:update`	Update application settings, license levels, and application API keys.
`applications:delete`	Delete applications.
`licenses:read`	Read license metadata and tables.
`licenses:create`	Create licenses.
`licenses:update`	Pause, extend, reset, blacklist, reinitialize, link, or edit licenses.
`licenses:delete`	Delete one or all licenses.
`app_users:read`	Read app user metadata and tables.
`app_users:create`	Create app users.
`app_users:update`	Reset client id, link license, or edit app users.
`app_users:delete`	Delete one or all app users.
`blacklists:read`	Read blacklist metadata and tables.
`blacklists:create`	Create blacklist entries.
`blacklists:update`	Edit blacklist entries.
`blacklists:delete`	Delete one or all blacklist entries.
`variables:read`	Read variables.
`variables:create`	Create variables.
`variables:update`	Edit variables.
`variables:delete`	Delete variables.
`files:read`	Read file metadata and file tables.
`files:upload`	Request file upload URLs and check upload state.
`files:delete`	Delete files or rename file records.
`sessions:read`	Read live session data.
`sessions:disconnect`	Disconnect live sessions.
`account:read`	Read account plan limits.

Application access

Each key can be created with:

allApplications: true, which allows any current or future application;
allApplications: false plus applicationIds, which restricts the key to specific applications.

Routes without applicationId use only the scope check. Routes with applicationId also require access to that application.

Action scopes

Action endpoints choose their scope from the requested action:

Endpoint	Delete actions	Other actions
`/license-action`	`licenses:delete`	`licenses:update`
`/users-action`	`app_users:delete`	`app_users:update`
`/blacklist-action`	`blacklists:delete`	Not applicable
`/file-action`	`files:delete`	`files:delete`

Scopes

Application access

Action scopes

On this page