Scopes and entitlements
A scope decides what a token can do. Your entitlement profile, assigned by Ryno, decides which scopes you can ask for.
Scopes
| Scope | Allows |
|---|---|
partner.read | Every GET route. |
partner.write | Every POST and PATCH route. |
partner.webhooks | Reserved. No Partner API route needs it, because webhooks are managed in the Partner Portal. |
A valid token without the scope a route needs is rejected with 403 Forbidden. The API gateway sends that 403 with an empty body; if it reaches an endpoint instead, the body is the response envelope with code Auth.Forbidden.
Entitlement profiles
partner.read is in every token. Optional scopes are only granted when you request them in the token request's scope field.
| Profile | Always granted | Granted on request |
|---|---|---|
STANDARD | partner.read | partner.write |
READ_ONLY | partner.read | none |
STANDARD_WITH_WEBHOOKS | partner.read | partner.write, partner.webhooks |
WEBHOOK_OPERATOR | partner.read | partner.webhooks |
Credentials registered in the Partner Portal get STANDARD. The profile is shown on the API Credentials page. Contact support to change it.
Request only what you need
Ask for partner.write only in the process that writes. A read-only reporting job should request partner.read alone, which limits the damage if its token leaks.