Permissions (scopes)
Choose what your integration can read or change.
A scope is a permission on your API key. Each endpoint lists the permission it needs. Workspace access and token type still apply even when a scope is selected.
| Scope | What it allows |
|---|---|
workspaces:read | Find accessible workspaces and their IDs, read a workspace's credit balance and contact capacity, and read workspace settings such as the AI SDR knowledge base. |
workspaces:write | Replace the AI SDR knowledge base (a workspace API key, or a personal token whose owner is a workspace owner or admin). The same scope also covers the existing workspace create, update and delete endpoints and onboarding-knowledge updates, which accept only personal tokens held by eligible users. Signed-in MCP connections never receive it. |
people:read | Search, list and read People and their allowed relationships. |
people:write | Create and update People, and link People to Companies or Deals. |
companies:read | Search, list and read Companies and their allowed relationships. |
companies:write | Create and update Companies, and link Companies to People or Deals. |
deals:read | List and read Deals and their allowed relationships. |
deals:write | Create and update Deals, including guarded stage changes, and link Deals to People or Companies. |
members:read | Discover active workspace members that can own or be assigned CRM records. |
pipelines:read | Discover CRM pipelines and stages used by Deals. |
customFields:read | Discover CRM custom-field definitions and read values returned with records. |
tasks:read | List and read CRM Tasks. |
tasks:write | Create, update and complete CRM Tasks. |
notes:read | List and read CRM Notes. |
notes:write | Create and update CRM Notes. |
campaigns:read | Read campaigns and metrics; check launch readiness. |
campaigns:write | Create and update campaigns, manage sequences, import or search and attach leads, duplicate, launch and pause. Requires a workspace API key. |
campaignLeads:read | Read campaign leads, including their user-facing custom variables, and export them as CSV. |
leads:read | Generate filters and preview standalone lead searches. Requires a workspace API key for these operations. |
leads:search | Run a paid standalone lead search and export its results. Requires a workspace API key. |
webhooks:write | Register an HTTPS endpoint for event updates. Personal tokens also require the user to be a workspace owner or admin. |
campaigns:write includes actions that spend credits or send real email. It is not a draft-only permission. Only grant it to integrations you trust to take those actions.
Start with workspaces:read and only the read scopes your integration needs. Add the matching write scopes when you are ready to change CRM records or campaigns.
Direct CRM API endpoints accept personal tokens or workspace API keys with the required scopes and workspace access. Static-key CRM MCP connections require a workspace API key in addition to those scopes. Signed-in MCP connections use the Read-only or Full access level selected during OAuth approval.
A missing permission returns 403 Forbidden. Create a replacement key with the required scopes; existing keys cannot have their scopes edited. Create an API key.