Get started

Scopes

A key does only what its scopes allow, inside the company’s plan.

A scope is an app and a level. A higher level includes the lower one: sales:approve can also write and read. Each operation in the reference lists the capability it needs and the scopes that carry it.

Scope	Allows
`sales:read`	Quotations, sales orders, invoices, credit notes and e-invoices; contacts and products.
`sales:write`	Also create and edit drafts, confirm, invoice orders, cancel, and issue an invoice already approved; create contacts and products.
`sales:approve`	Also approve invoices and credit notes, and issue a draft in one step. `POST /einvoices` needs it.
`purchase:read`	Requests for quotation, purchase orders, bills and refunds; contacts and products.
`purchase:write`	Also create and edit them, confirm, bill orders and cancel; create contacts and products.
`purchase:approve`	Also post bills and refunds into the accounts.
`contacts:read` · `contacts:write`	The contact book on its own, without sales or purchases.
`reports:read`	The VAT 201 return (with `sales:read` or `purchase:read`) and aged receivable (with `sales:read`).
`accounting:read`	Aged payable and the trial balance. Offered only while Accounting is in the company’s plan.

The limits on any key

A key is never more than the person who creates it: a scope above theirs is refused (API_SCOPE_ABOVE_YOURS), and so is an app outside the plan (API_SCOPE_NOT_IN_PLAN).
A key never manages users, keys, billing or the company’s settings, whatever its scopes.
An app the company’s plan does not hold is refused even to a key that names it (APP_LOCKED).
GET /me answers what the key may do right now — use it rather than tracking scopes yourself.

Give each key the least it needs. A shop that only sends invoices needs sales:approve; a reporting tool needs reports:read and sales:read.