Scopes
API key permissions — what each scope grants access to.
Overview
API keys are permission-scoped. When you create a key, you choose which scopes to enable. A request to an endpoint that requires a scope your key doesn't have returns 403 Insufficient Scope.
Available Scopes
| Scope | Grants access to |
|---|---|
applications:read | Read camp applications |
applications:write | Manage camp applications |
audit:read | Read audit logs |
bookkeeping:read | Read bookkeeping records |
budget:read | Read camp budget |
checkins:read | Read member check-ins |
checkins:write | Manage member check-ins |
documents:read | Read camp documents and signatures |
documents:write | Manage camp documents and signatures |
dues:read | Read dues records |
dues:write | Manage dues records |
emails:read | Read camp email |
emails:write | Manage camp email |
export:read | Read camp data exports |
inventory:read | Read camp inventory |
kitchen:read | Read kitchen assignments |
logistics:read | Read camp logistics |
meetings:read | Read camp meetings |
meetings:write | Manage camp meetings |
members:read | Read member records |
members:write | Manage member records |
onboarding:read | Read member onboarding progress |
onboarding:write | Manage member onboarding progress |
org:read | Read organization configuration |
reports:read | Read camp reports |
sap:read | Read Setup Access Pass allocations and assignments |
sap:write | Manage Setup Access Pass allocations and assignments |
scholarships:read | Read scholarship requests |
scholarships:write | Manage scholarship requests |
shifts:read | Read shift schedules and signups |
shifts:write | Manage shift schedules and signups |
tasks:read | Read camp tasks |
tickets:read | Read camp tickets |
tickets:write | Manage camp tickets |
vehicle-passes:read | Read vehicle passes |
vehicle-passes:write | Manage vehicle passes |
vendors:read | Read camp vendors |
Principle of Least Privilege
Grant only the scopes your integration actually needs:
- A public-facing member directory only needs
members:read - A dues reminder bot needs
members:read+dues:read - A shift scheduling dashboard needs
members:read+shifts:read - A full AI agent integration (via MCP) needs read + write scopes for the resources it manages
Scope Enforcement
Scopes are enforced server-side on every request regardless of what the client sends. There is no way to elevate a key's permissions without regenerating it with wider scopes in the admin panel.