# Scopes

> The complete list of API-key scopes, grouped by module. A key can only do what its scopes allow.

Source: https://app.assetlab.ca/docs/reference/scopes

Scopes are chosen when an [API key](/docs/manage/api-keys) is created and can't be widened afterward - mint a new key to change access. Most resources have a `:read` and a `:write` scope; a few are read-only by nature. The wildcard `*:*` grants everything.

`:write` covers create, update, and delete. A write scope without its read scope is rarely useful - grant them together.

## Registry

| Scope family | Read | Write |
|---|---|---|
| `assets` | ✓ | ✓ |
| `sites` / `buildings` / `locations` | ✓ | ✓ |
| `systems` (classes, groups, systems) | ✓ | ✓ |
| `asset_types` / `asset_type_groups` | ✓ | ✓ |
| `asset_statuses` | ✓ | ✓ |
| `building_types` / `location_types` | ✓ | ✓ |
| `manufacturers` | ✓ | ✓ |
| `custom_fields` | ✓ | ✓ |
| `asset_placements` | ✓ | ✓ |
| `floorplans` / `floorplan_regions` | ✓ | ✓ |

## Asset records

| Scope family | Read | Write |
|---|---|---|
| `asset_comments` | ✓ | ✓ |
| `asset_costs` | ✓ | ✓ |
| `asset_documents` | ✓ | ✓ |
| `asset_parts` | ✓ | ✓ |
| `asset_condition_assessments` | ✓ | ✓ |
| `asset_replacement_plans` | ✓ | ✓ |
| `asset_risk_history` | ✓ | read-only |

## CMMS

| Scope family | Read | Write |
|---|---|---|
| `work_orders` / `work_order_comments` | ✓ | ✓ |
| `work_order_schedules` | ✓ | ✓ |
| `work_requests` | ✓ | ✓ |
| `work_categories` | ✓ | ✓ |
| `pm_schedules` / `pm_templates` | ✓ | ✓ |
| `form_templates` / `form_template_items` | ✓ | ✓ |
| `form_responses` | ✓ | ✓ |
| `form_response_answers` | ✓ | read-only |
| `parts` / `part_categories` | ✓ | ✓ |
| `vendors` / `vendor_site_assignments` | ✓ | ✓ |
| `contracts` / `contract_sites` / `contract_documents` | ✓ | ✓ |
| `compliance` / `compliance_records` | ✓ | ✓ |

## Financials

| Scope family | Read | Write |
|---|---|---|
| `expenses` | ✓ | ✓ |
| `invoices` | ✓ | ✓ |
| `purchase_orders` | ✓ | ✓ |
| `budgets` | ✓ | ✓ |
| `change_orders` | ✓ | ✓ |
| `cost_categories` | ✓ | ✓ |

## Projects

| Scope family | Read | Write |
|---|---|---|
| `projects` | ✓ | ✓ |
| `project_tasks` / `project_task_dependencies` | ✓ | ✓ |
| `project_milestones` / `project_phases` / `project_phase_categories` | ✓ | ✓ |
| `project_budget_items` / `project_cost_snapshots` | ✓ | ✓ |
| `project_risks` / `project_updates` / `project_comments` | ✓ | ✓ |
| `project_team_members` / `project_time_entries` | ✓ | ✓ |
| `project_documents` / `project_document_folder_templates` | ✓ | ✓ |
| Scope links: `project_sites`, `project_buildings`, `project_locations`, `project_assets`, `project_systems`, `project_system_classes`, `project_system_groups`, `project_infrastructure_assets` | ✓ | ✓ |

## Infrastructure & planning

| Scope family | Read | Write |
|---|---|---|
| `infrastructure_networks` | ✓ | ✓ |
| `infrastructure_feature_classes` | ✓ | ✓ |
| `infrastructure_assets` (features) | ✓ | ✓ |
| `infrastructure_asset_inspections` | ✓ | ✓ |
| `infrastructure_asset_costs` / `_parts` / `_documents` / `_comments` | ✓ | ✓ |
| `infrastructure_zones` | ✓ | ✓ |
| `infrastructure_asset_risk_history` | ✓ | read-only |
| `service_areas` | ✓ | ✓ |
| `los_measures` / `los_measurements` | ✓ | ✓ |

## Analytics & platform

| Scope family | Read | Write |
|---|---|---|
| `dashboard` | ✓ | read-only |
| `dashboard_snapshots` | ✓ | read-only |
| `site_fci_history` | ✓ | read-only |
| `users` | ✓ | read-only |
| `attachments` | ✓ | ✓ |
| `upload_urls` | - | write-only (mint upload URLs) |

## Suggested bundles

| Purpose | Grant |
|---|---|
| BI / reporting | All `:read` |
| AI assistant, phase 1 | All `:read` ([why](/docs/ai/security-model)) |
| Maintenance copilot | Reads + `work_orders`, `work_requests`, `work_order_comments`, `pm_schedules`, `form_templates`, `form_template_items`:write |
| Full integration | `*:*` |