Process CartAPI

Scopes

What each API key scope allows, and the read-only rule.

View this page as Markdown

A key holds one or more action scopes; an operation names the one it needs (the reference pages and the OpenAPI document carry it as x-processcart-scope). * is every scope, present and future.

Scope Label Allows
runs:read Read runs List and read runs, tasks, field values, comments and activity.
runs:write Write runs Start runs, set field values, complete / reopen tasks, comment, upload files, trash and restore.
approvals:decide Decide approvals Approve or reject approval tasks (acts with Admin authority on approvals).
workflows:read Read workflows List workflows, read their published schema and export the portable template.
workflows:write Write workflows Create workflows from a template JSON and change workflow settings (name, description, folder, Key Date field, archive / unarchive).
views:read Read saved views List saved views and query the runs board.
views:write Write saved views Create saved views and update views owned by the key's creator; delete any shared view in the workspace (Admin power, audited).
webhooks:manage Manage webhooks Create, update, test, disable and delete webhooks; read and redeliver deliveries.
schedules:manage Manage schedules Create, update, pause, resume, preview and delete recurrence schedules, and start a schedule's run now (the response is the full Run with its field values).
rules:manage Manage automation rules Create, update, enable, disable and delete automation rules, and read their execution log. A rule's actions change runs (fields, status, priority, labels, task assignees), notify members and call webhooks.
users:read Read users & groups List members and groups (ids, names, roles).
* Full access Every scope, present and future.

Rules

  • Read-only keys may only make GET and HEAD requests, whatever scopes they hold — a read-only key with webhooks:manage can list webhooks but never change one (403 read_only_key).
  • A missing scope is a 403 insufficient_scope; the detail names the scope.
  • approvals:decide is never implied by runs:write: a key that holds it decides approvals with Admin authority (approve, reject, reopen an approval).
  • A key may also carry a workflow or folder allowlist; see Authentication & API keys.
  • /v1/me needs no particular scope — any valid key may identify itself; /v1/health needs no key at all.