Scopes

Expedify uses coarse, least-privilege scopes of the form {resource}:{action}. A key holds a set of them; every operation declares the one it needs. Default-deny: no scope → no access. This model is shared by the REST API and MCP.

write / author / run imply read on the same resource — you never grant the read counterpart separately.

CRM

Per entity — contacts, companies, deals, tasks, notes, activities, products, deal_payments, deal_payment_schedules:

Scope	Grants
<entity>:read	View and list; get; list associations
<entity>:write	Create, update, delete; link / unlink (implies read)

Associations require the scope on both sides — linking a contact to a company needs contacts:write and companies:write.

Generic records

The entity-agnostic MCP tools — search_records, get_record, create_record, update_record, delete_record, link_records, and batch_*_records, where the entity is a parameter rather than part of the path — are gated by one coarse pair instead of the per-entity scopes:

Scope	Grants
records:read	Search/get any CRM record of any entity type
records:write	Create/update/delete/link any CRM record, including batch writes (implies read)

REST batch uses the per-entity scope

The REST batch endpoints (POST /v1/objects/{entity}/batch/*) name the entity in the path, so they take the ordinary {entity}:write — not records:write. Only the entity-agnostic MCP tools above use the records:* pair.

Workflows

Scope	Grants
workflows:read	List nodes, read/list workflows, validate, read executions
workflows:author	Create, edit, import, activate/deactivate, delete (implies read)
workflows:run	Run and test workflows and single nodes (implies read)

author and run are separate so a key can be "build only" or "run only". Runs are additionally confirm-gated.

Knowledge Base

Scope	Grants
knowledge:read	List KBs, read documents, search, ask (RAG)
knowledge:write	Create/update/delete KBs and documents (implies read)

Analytics

Scope	Grants
analytics:read	List/read datasets, charts, dashboards; run queries/charts; NL→SQL; inspect schema
analytics:write	Create/update/delete datasets, charts, and dashboards (implies read)

Channels

Scope	Grants
templates:read / templates:write	List/read marketing templates; create, update, delete (implies read)
assets:read / assets:write	List/read marketing assets; upload, update, delete (implies read)
segments:read / segments:write	List/read segments, evaluate & preview audiences; create, update, delete (implies read)
campaigns:read / campaigns:write	List/read campaigns; create, update, cancel (implies read)
campaigns:send	Launch campaigns — real, mass, billable outbound (implies read)
communications:read	Read voice calls, WhatsApp conversations & messages, and SMS activity logs (read-only)

campaigns:send is deliberately separate from campaigns:write — a key can build and schedule campaigns without ever being able to fire one. Sends are additionally confirm-gated.

Settings

Scope	Grants
integrations:read	Browse the integration catalog and list/read the org's connected integrations (never exposes credentials)
integrations:write	Run live connection tests — makes a real outbound call to the provider with stored credentials (implies read)
webhooks:read	List/read incoming & outgoing webhooks, their logs, and event types
webhooks:write	Create, update, delete, and test webhooks — returns generated secrets once; outgoing URLs are SSRF-validated (implies read)

Automation (Blueprints)

Scope	Grants
blueprints:read	Read/list a workflow's visual Blueprint and validate it
blueprints:write	Create, replace, and clear a workflow's Blueprint (implies read)

Search

Scope	Grants
search:read	Cross-entity find-by-name over workflows, charts, dashboards, and datasets

Choosing scopes

Grant the narrowest set that does the job:

• A reporting integration → the relevant …:read scopes.
• A data-entry integration → add the …:write it needs.
• An automation runner → workflows:run (+ any entity reads it needs).

You pick these in the scope picker when minting a key (Settings → API Keys). Each operation in this reference and each tool in the MCP catalog states its required scope.