Scopes
Permission scopes on API keys and how they map to routes.
Each key has an explicit list of scopes. Routes require one or more scopes; missing scopes return 403 with PUBLIC_API_SCOPE_DENIED.
Catalog
| Scope | Used for |
|---|---|
workspaces:read | List / get workspaces |
projects:read | List / get projects, project processing status |
projects:write | Create projects, pause / resume tracking |
contexts:read / contexts:write | Search contexts (roadmap) |
keywords:read / keywords:write | Keyword list / add / delete / frequency |
rankings:read | SEO keyword and AEO prompt rankings / detail |
competitors:read | SEO keyword-gap, AEO prompt-gap, and competitor selections (read) |
competitors:write | Competitor selection writes (not public yet) |
tools:read | List / get / poll tool jobs |
tools:write | Create / delete tool jobs |
usage:read | Credits and account limits |
exports:read / exports:write | Export jobs (roadmap) |
Workspace allowlist
A key may be limited to specific workspaces. Calls to other workspace ids return PUBLIC_API_WORKSPACE_DENIED.
Least privilege
Create a separate key per integration (for example Looker, Zapier, or a reporting pipeline) with only the scopes that integration needs. Rotate or revoke keys in Organization settings when an integration is retired.