Scopes

Expedify uses coarse, least-privilege scopes of the form {resource}:{action}. A key holds a set of them; every operation declares the one it needs. Default-deny: no scope → no access. This model is shared by the REST API and MCP.

write / author / run imply read on the same resource — you never grant the read counterpart separately.

CRM

Per entity — contacts, companies, deals, tasks, notes, activities:

Scope	Grants
<entity>:read	View and list; get; list associations
<entity>:write	Create, update, delete; link / unlink (implies read)

Associations require the scope on both sides — linking a contact to a company needs contacts:write and companies:write.

Workflows

Scope	Grants
workflows:read	List nodes, read/list workflows, validate, read executions
workflows:author	Create, edit, import, activate/deactivate, delete (implies read)
workflows:run	Run and test workflows and single nodes (implies read)

author and run are separate so a key can be "build only" or "run only". Runs are additionally confirm-gated.

Knowledge Base

Scope	Grants
knowledge:read	List KBs, read documents, search, ask (RAG)
knowledge:write	Create/update/delete KBs and documents (implies read)

Analytics

Scope	Grants
analytics:read	List/read datasets, charts, dashboards; run queries/charts; NL→SQL; inspect schema
analytics:write	Create/update/delete datasets, charts, and dashboards (implies read)

Choosing scopes

Grant the narrowest set that does the job:

• A reporting integration → the relevant …:read scopes.
• A data-entry integration → add the …:write it needs.
• An automation runner → workflows:run (+ any entity reads it needs).

You pick these in the scope picker when minting a key (Settings → API Keys). Each operation in this reference and each tool in the MCP catalog states its required scope.