OAuth scopes

Scopes are the single source of truth for what a token can do. Request only what you need — consumers see every scope on the consent screen and excess scopes drive denial rates up.

Consumer scopes

Granted by a consumer through the authorize flow. Token kind: user (account_type=consumer).

Scope	Description
`consumer.profile.read`	Read the consumer's profile, contacts, and addresses.
`consumer.profile.write`	Update the consumer's profile, contacts, and addresses.
`consumer.documents.read`	List and download the consumer's documents.
`consumer.documents.write`	Upload and delete the consumer's documents.
`consumer.grants.read`	List consent grants the consumer has issued.
`consumer.grants.revoke`	Revoke a consent grant the consumer has issued.
`consumer.history.read`	Read activity history for the consumer.
`consumer.notifications.read`	Read notifications addressed to the consumer.
`consumer.notifications.write`	Mark notifications as read for the consumer.
`consumer.consent.read`	Inspect pending consent sessions for the consumer.
`consumer.consent.respond`	Approve or deny a pending consent session.

Partner staff scopes

Granted by a partner staff user. Token kind: user (account_type=staff).

Scope	Description
`partner.products.read`	List the partner's products.
`partner.products.write`	Create, update, and delete the partner's products.
`partner.members.read`	List the partner's staff members.
`partner.members.write`	Invite, update, and remove the partner's staff members.
`partner.api_keys.read`	List the partner's API client metadata.
`partner.api_keys.write`	Create or revoke the partner's API clients.
`partner.webhooks.read`	List the partner's webhooks and delivery history.
`partner.webhooks.write`	Create, update, delete, and test the partner's webhooks.
`partner.billing.read`	Read the partner's billing summary and usage.
`partner.requests.read`	List inbound consent/application requests for the partner.
`partner.requests.write`	Act on inbound requests for the partner.

Client-credentials scopes

Server-to-server only, no user context. Token kind: client (grant_type=client_credentials).

Scope	Description
`sessions.create`	Create application sessions for a partner.
`sessions.read`	Read application sessions and consented data.
`sessions.revoke`	Revoke an application session.