Permissions and Scopes

Permissions and scopes decide what an authenticated caller is allowed to do after passing the base authentication checks.

Web Chain

In the WEB chain, access is typically shaped by:

1. portal type
2. user role
3. workspace membership
4. endpoint-level permission checks

API Chain

In the API chain, access is typically shaped by:

1. whether the endpoint is API-exposed at all
2. the scope bound to the endpoint
3. the scopes bound to the API key

Important Rule

An endpoint can be fully documented and still be unavailable to the API chain. If it does not declare API scope support, the request is denied by design.

Read Next

1. Web vs API Chain
2. Error Model