Scopes

Personal API keys and OAuth tokens carry scopes. A missing scope returns 401 with error.type of INSUFFICIENT_SCOPE.

Resource scopes

Domain	Read	Write
Tickets	`tickets:read`	`tickets:write`
Conversations	`conversations:read`	`conversations:write`
Messages	`messages:read`	`messages:write`
Companies, contacts, notes, documents	`companies:read`	`companies:write`
Teams	`teams:read`	`teams:write`
Attachments	`attachments:read`	`attachments:write`
Webhook subscriptions	`webhooks:read`	`webhooks:write`
Workspace profiles and workspace info	`workspace:read`	—

Write on a resource includes read for that resource. Workspace info is read-only.

These expand to every resource scope.

Grant the narrowest resource scopes that the integration needs. admin is not grantable to OAuth app actors.