OAuth scopes

Scopes are the single source of truth for what a token can do. Request only what you need — consumers see every scope on the consent screen and excess scopes drive denial rates up.

Consumer scopes

Granted by a consumer through the authorize flow. Token kind: user (account_type=consumer).

Scope	Description
`consumer.profile.read`	Read the consumer's profile, contacts, and addresses.
`consumer.profile.write`	Update the consumer's profile, contacts, and addresses.
`consumer.documents.read`	List and download the consumer's documents.
`consumer.documents.write`	Upload and delete the consumer's documents.
`consumer.grants.read`	List consent grants the consumer has issued.
`consumer.grants.revoke`	Revoke a consent grant the consumer has issued.
`consumer.history.read`	Read activity history for the consumer.
`consumer.notifications.read`	Read notifications addressed to the consumer.
`consumer.notifications.write`	Mark notifications as read for the consumer.
`consumer.consent.read`	Inspect pending consent sessions for the consumer.
`consumer.consent.respond`	Approve or deny a pending consent session.

Client staff scopes

Granted by a client staff user. Token kind: user (account_type=staff).

Scope	Description
`partner.products.read`	Read the client's products and immutable versions.
`partner.products.write`	Create drafts and publish or archive products.
`partner.opportunities.read`	Search and read the client's opportunities.
`partner.opportunities.write`	Update opportunities, notes, tasks, and outcomes.
`partner.webhooks.read`	Read webhook endpoints and delivery diagnostics.
`partner.webhooks.write`	Manage webhook endpoints and redeliver events.

Client-credentials scopes

Server-to-server only, no user context. Token kind: client (grant_type=client_credentials).

Scope	Description
`sessions.create`	Create application sessions for a client.
`sessions.read`	Read application sessions and consented data.
`sessions.revoke`	Revoke an application session.