Permissions (scopes)
Choose what your integration can read or change.
A scope is a permission on your API key. Each endpoint lists the permission it needs. Workspace access and token type still apply even when a scope is selected.
| Scope | What it allows |
|---|---|
workspaces:read | Find accessible workspaces and their IDs. |
campaigns:read | Read campaigns and metrics; check launch readiness. |
campaigns:write | Create and update campaigns, manage sequences, search and attach leads, duplicate, launch and pause. Requires a workspace API key. |
campaignLeads:read | Read campaign leads and export them as CSV. |
leads:read | Generate filters and preview standalone lead searches. Requires a workspace API key for these operations. |
leads:search | Run a paid standalone lead search and export its results. Requires a workspace API key. |
webhooks:write | Register an HTTPS endpoint for event updates. Personal tokens also require the user to be a workspace owner or admin. |
campaigns:write includes actions that spend credits or send real email. It is not a draft-only permission. Only grant it to integrations you trust to take those actions.
Start with workspaces:read and campaigns:read for reporting. Add campaignLeads:read if you need individual lead records. Select write permissions when you are ready to implement those workflows.
A missing permission returns 403 Forbidden. Create a replacement key with the required scopes; existing keys cannot have their scopes edited. Create an API key.