# Scopes

> What each API key scope allows, and the read-only rule.

Source: https://developers.processcart.com/reference/scopes

A key holds one or more action scopes; an operation names the one it needs (the reference pages and the OpenAPI document carry it as `x-processcart-scope`). `*` is every scope, present and future.

| Scope | Label | Allows |
| --- | --- | --- |
| `runs:read` | Read runs | List and read runs, tasks, field values, comments and activity. |
| `runs:write` | Write runs | Start runs, set field values, complete / reopen tasks, comment, upload files, trash and restore. |
| `approvals:decide` | Decide approvals | Approve or reject approval tasks (acts with Admin authority on approvals). |
| `workflows:read` | Read workflows | List workflows, read their published schema and export the portable template. |
| `workflows:write` | Write workflows | Create workflows from a template JSON and change workflow settings (name, description, folder, Key Date field, archive / unarchive). |
| `views:read` | Read saved views | List saved views and query the runs board. |
| `views:write` | Write saved views | Create saved views and update views owned by the key's creator; delete any shared view in the workspace (Admin power, audited). |
| `webhooks:manage` | Manage webhooks | Create, update, test, disable and delete webhooks; read and redeliver deliveries. |
| `schedules:manage` | Manage schedules | Create, update, pause, resume, preview and delete recurrence schedules, and start a schedule's run now (the response is the full Run with its field values). |
| `rules:manage` | Manage automation rules | Create, update, enable, disable and delete automation rules, and read their execution log. A rule's actions change runs (fields, status, priority, labels, task assignees), notify members and call webhooks. |
| `users:read` | Read users & groups | List members and groups (ids, names, roles). |
| `*` | Full access | Every scope, present and future. |

## Rules

- **Read-only keys** may only make `GET` and `HEAD` requests, whatever scopes they hold — a read-only key with `webhooks:manage` can list webhooks but never change one (403 `read_only_key`).
- A missing scope is a 403 `insufficient_scope`; the `detail` names the scope.
- `approvals:decide` is never implied by `runs:write`: a key that holds it decides approvals with Admin authority (approve, reject, reopen an approval).
- A key may also carry a **workflow or folder allowlist**; see [Authentication & API keys](https://developers.processcart.com/guides/authentication#allowlists).
- `/v1/me` needs no particular scope — any valid key may identify itself; `/v1/health` needs no key at all.