Authorization and Scopes
Scope checks are enforced per endpoint.
Available Scopes
| Scope | Company keys | Agency keys | Covers |
|---|---|---|---|
read:companies | Yes | Yes | company list and competency matrix; company-scoped keys also cover company detail, regions, sectors, connected agencies, company tags, company custom roles, and company umbrellas |
write:users | Yes | Yes | Create users and update profiles or memberships for hirer users with company keys, or agency users with agency keys; key-owner permissions also apply |
read:users | Yes | Yes | List users visible to the key owner; company assignment and permission reports remain company-only |
read:trades | Yes | Yes | trades and trade detail; agency-scoped keys can access trade detail only |
read:rates | Yes | Yes | standalone rates |
read:projects | Yes | No | projects and project connected agencies |
read:workers | Yes | Yes | workers and worker document detail |
write:workers | Yes | Yes | Agency keys can create and update workers; company keys can validate worker attachment and right-to-work documents |
read:purchase-orders | Yes | No | purchase orders |
read:sites | Yes | Yes | site access, including agency access where permitted |
read:requisitions | Yes | Yes | requisitions |
read:assignments | Yes | Yes | assignments |
read:timesheets | Yes | Yes | timesheets and expenses |
read:invoices | Yes | Yes | invoices, AfP, and payment notices |
write:invoices | Yes | Yes | Update invoice status; agency keys require the hiring company’s Update invoice status agency action |
read:credit-notes | Yes | Yes | credit notes |
No broad super-key behavior is granted by default.
User assignment and permission access requires read:users. Existing keys with only read:companies must be updated to grant this scope. Agency-scoped keys with read:users can retrieve their own agency users through GET /users. Company assignment and permission endpoints remain unavailable for agency-scoped keys.
Listing default RBAC access rule mappings requires a valid company-scoped key, with no resource scope required. Agency-scoped keys cannot access this endpoint.