Permissions
What a request can do depends on two things: the scopes of your API key or app connection, and your roles in the workspace and project.
Scopes
Each endpoint's reference page shows the scope it needs. A key or connection can call only the endpoints its scopes allow. With no scopes, it can call only Ping.
| Scope | Allows |
|---|---|
projects:read | Searching and reading projects |
projects:write | Creating and updating projects, and scheduling or canceling their deletion |
folders:read | Listing and reading folders |
folders:write | Creating, updating, and deleting folders |
files:read | Listing and reading files |
files:write | Uploading, updating, tagging, and deleting files |
files:download | Getting file download URLs |
ai:generate | Listing AI models, generating files with AI, and uploading generation attachments |
comments:read | Listing and reading comments, replies, and reactions |
comments:write | Creating, updating, and deleting comments, reactions, and comment attachments |
comments:download | Getting comment attachment download URLs |
workspace-members:read | Listing workspace members |
project-members:read | Listing project members |
project-members:write | Adding, updating, and removing project members |
access-links:read | Listing and reading access links |
access-links:write | Creating, updating, and deleting access links |
access-links:read.key | Seeing the accessKey of access links. Without it, accessKey is null |
skills:read | Listing and reading skills and skill versions |
skills:write | Creating, updating, and deleting skills, and publishing or deleting skill versions |
Roles
Requests act as you, so you can reach the same projects you can open in the app:
- Projects you have joined
- Projects open to the whole workspace
- Every project in the workspace, if you are a workspace owner or manager
- Projects another workspace has connected to yours
Endpoints that need a project role list the allowed roles on their reference page.
Some actions are limited to the person who created the item:
- Editing or deleting a comment: its author
- Completing a file upload: the person who started it
- Completing, canceling, or deleting a comment attachment: the person who uploaded it
Restricted files
Restricted Reviewers see only files shared with them (allowRestricted is true). The same applies when you open a project through your workspace role without joining it.
Plan features
AI file generation and skills are available only on plans that include them.
Archived projects
Archived projects are read-only. You can still get download URLs, remove project members, and delete access links.