API Scopes

API keys can have different scopes that control what actions they can perform. When creating an API key, you can select which scopes to enable.

Available Scopes

Scope Requirements

Each API endpoint requires specific scopes:

• Read operations (GET): Require campaigns:read
• Write operations (POST, PATCH, DELETE): Require campaigns:write
• PKPASS verification: Requires pkpass:verify

Insufficient Scopes

If your API key doesn't have the required scope for an endpoint, you'll receive a 403 Forbidden response:

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_SCOPES",
    "message": "Required scopes: campaigns:write"
  }
}

Best Practices

Use Minimal Scopes

Only grant the minimum scopes needed for each API key. This follows the principle of least privilege:

• Read-only keys: Use campaigns:read for monitoring, reporting, or read-only integrations
• Write keys: Use campaigns:write for applications that create or update resources
• Separate keys: Create different keys for different services or environments

Scope Examples

Monitoring Service (read-only):

Scopes: campaigns:read
Use case: Dashboard, reporting, analytics

Integration Service (full access):

Scopes: campaigns:read, campaigns:write
Use case: Full API integration

Verification Tool (verification only):

Scopes: pkpass:verify
Use case: PKPASS file validation

Checking Scopes

You can verify which scopes your API key has by checking the dashboard or by making a test request. If you receive an INSUFFICIENT_SCOPES error, you'll need to create a new API key with the required scopes.