Scopes

The complete list of API-key scopes, grouped by module. A key can only do what its scopes allow.

Scopes are chosen when an API key is created and can't be widened afterward - mint a new key to change access. Most resources have a :read and a :write scope; a few are read-only by nature. The wildcard *:* grants everything.

:write covers create, update, and delete. A write scope without its read scope is rarely useful - grant them together.

Registry

Scope family	Read	Write
`assets`	✓	✓
`sites` / `buildings` / `locations`	✓	✓
`systems` (classes, groups, systems)	✓	✓
`asset_types` / `asset_type_groups`	✓	✓
`asset_statuses`	✓	✓
`building_types` / `location_types`	✓	✓
`manufacturers`	✓	✓
`custom_fields`	✓	✓
`asset_placements`	✓	✓
`floorplans` / `floorplan_regions`	✓	✓

Asset records

Scope family	Read	Write
`asset_comments`	✓	✓
`asset_costs`	✓	✓
`asset_documents`	✓	✓
`asset_parts`	✓	✓
`asset_condition_assessments`	✓	✓
`asset_lifecycle_events`	✓	✓
`asset_betterments`	✓	✓
`asset_replacement_plans`	✓	✓
`asset_risk_history`	✓	read-only

CMMS

Scope family	Read	Write
`work_orders` / `work_order_comments`	✓	✓
`work_order_schedules`	✓	✓
`work_requests`	✓	✓
`work_categories`	✓	✓
`pm_schedules` / `pm_templates`	✓	✓
`form_templates` / `form_template_items`	✓	✓
`form_responses`	✓	✓
`form_response_answers`	✓	read-only
`parts` / `part_categories`	✓	✓
`vendors` / `vendor_site_assignments`	✓	✓
`contracts` / `contract_sites` / `contract_documents`	✓	✓
`compliance` / `compliance_records`	✓	✓

Financials

Scope family	Read	Write
`expenses`	✓	✓
`invoices`	✓	✓
`purchase_orders`	✓	✓
`budgets`	✓	✓
`change_orders`	✓	✓
`cost_categories`	✓	✓

Projects

Scope family	Read	Write
`projects`	✓	✓
`project_tasks` / `project_task_dependencies`	✓	✓
`project_milestones` / `project_phases` / `project_phase_categories`	✓	✓
`project_budget_items` / `project_cost_snapshots`	✓	✓
`project_risks` / `project_updates` / `project_comments`	✓	✓
`project_team_members` / `project_time_entries`	✓	✓
`project_documents` / `project_document_folder_templates`	✓	✓
Scope links: `project_sites`, `project_buildings`, `project_locations`, `project_assets`, `project_systems`, `project_system_classes`, `project_system_groups`, `project_infrastructure_assets`	✓	✓

Infrastructure & planning

Scope family	Read	Write
`infrastructure_networks`	✓	✓
`infrastructure_feature_classes`	✓	✓
`infrastructure_lifecycle_events`	✓	✓
`infrastructure_assets` (features)	✓	✓
`infrastructure_asset_inspections`	✓	✓
`infrastructure_asset_costs` / `_parts` / `_documents` / `_comments`	✓	✓
`infrastructure_zones`	✓	✓
`infrastructure_asset_risk_history`	✓	read-only
`service_areas`	✓	✓
`los_measures` / `los_measurements`	✓	✓
`los_proposed_targets`	✓	✓
`los_targets` (system targets, infrastructure targets, criticality modifiers)	✓	✓
`los_consequences`	✓	✓
`los_status` (monthly status readings)	✓	read-only

Analytics & platform

Scope family	Read	Write
`dashboard`	✓	read-only
`dashboard_snapshots`	✓	read-only
`organization_settings`	✓	read-only
`site_fci_history`	✓	read-only
`users`	✓	read-only
`attachments`	✓	✓
`upload_urls`	-	write-only (mint upload URLs)

Suggested bundles

Purpose	Grant
BI / reporting	All `:read`
AI assistant, phase 1	All `:read` (why)
Maintenance copilot	Reads + `work_orders`, `work_requests`, `work_order_comments`, `pm_schedules`, `form_templates`, `form_template_items`:write
Full integration	`:`