> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stockshift.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and scopes

> Two checks run on every call: the member's permission and the token's scope.

Two checks run on every call, and both have to pass:

1. The member behind the token needs the **permission**, such as `catalog.items.create`. Permissions come from the member's role in the organization.
2. The token needs the **scope**, such as `catalog:write`. Scopes are chosen when the key is created or when a member approves an OAuth app.

A key with `catalog:write` still cannot create items if its owner's role does not allow it, and an owner's key limited to `inventory:read` cannot post adjustments. Either failure answers `403` with the code `forbidden`. Each endpoint in the API reference lists the permission and scope it needs.

## Scopes

Scopes come in a read and write pair for each area of the app. Read covers anything that only looks. Write covers anything that changes something. An API key can also hold `*`, which is every scope; an OAuth app cannot.

| Area | Scopes |
| - | - |
| Access | `access:read` |
| Audit history | `audit:read` |
| Address | `address:read`, `address:write` |
| Automation | `automation:read`, `automation:write` |
| Billing | `billing:read` |
| Catalog | `catalog:read`, `catalog:write` |
| Dashboard | `dashboard:read`, `dashboard:write` |
| Developer | `developer:read`, `developer:write` |
| Devices | `devices:read`, `devices:write` |
| Documents | `documents:read`, `documents:write` |
| Engineering | `engineering:read`, `engineering:write` |
| Insights | `insights:read`, `insights:write` |
| Integrations | `integrations:read`, `integrations:write` |
| Inventory | `inventory:read`, `inventory:write` |
| Labels | `labels:read`, `labels:write` |
| Library | `library:read` |
| Manufacturing | `manufacturing:read`, `manufacturing:write` |
| Notifications | `notifications:read`, `notifications:write` |
| Organization | `organization:read`, `organization:write` |
| Planning | `planning:read`, `planning:write` |
| Purchasing | `purchasing:read`, `purchasing:write` |
| Quality | `quality:read`, `quality:write` |
| Sales | `sales:read`, `sales:write` |
| Sync | `sync:read`, `sync:write` |

Give a key only the scopes its job needs. A key that feeds a stock dashboard needs `inventory:read` and nothing else.

## Plan limits

Some features depend on the organization's plan. A call to one the plan does not include answers `403` with the code `plan_upgrade_required`, and `feature` names what is missing. Nothing is written.


## Related topics

- [Authentication](https://docs.stockshift.io/guides/authentication.md)
- [Quickstart](https://docs.stockshift.io/quickstart.md)
- [API reference](https://docs.stockshift.io/api-reference/introduction.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.