Two things decide what a request can do.
1. The key’s permissions
Each API key has its own list of permissions, which you set on the Tokens page. Each endpoint in the API reference shows the permission it needs, such as clients.VIEW or clients.MANAGE.
If a key doesn’t have the permission, the API returns 403.
2. What the key’s owner can see
A key sees the same records as the person who created it. If that person only has access to one team or brand, so does the key.
Things to know
- Permissions are saved on the key when you set them. Changing someone’s role doesn’t change their existing keys, so review keys when roles change.
- Paid add-on features, such as telephony, can’t be reached with an API key.
- Password, two-factor and login session actions always need a signed-in person, so API keys can’t use them.
- A key with permission to manage API keys can create other keys, with any permission its owner has. Only give this permission when you need it.