# API scopes and permissions
URL: https://skedcast.com/developers/scopes

SkedCast's API scopes and permissions are intentionally narrow: read across your core resources, the core publish action, content-library writes, client management, and account connect links. Destructive account/post deletion, billing, team, and admin actions are never exposable to a token.

## Available API scopes and permissions
Scope | Access | Grants
`agency.read` | read | Read workspace profile
`clients.read` | read | Read clients
`accounts.read` | read | Read connected social accounts
`posts.read` | read | Read posts and schedule
`analytics.read` | read | Read analytics
`reports.read` | read | Read reports
`besttimes.read` | read | Read best-time recommendations
`media.read` | read | Read content library
`webhooks.read` | read | Read webhook endpoints and delivery logs
`approvals.read` | read | Read the approval queue
`campaigns.read` | read | Read campaigns
`posts.compose` | write | Create and schedule posts
`approvals.decide` | write | Approve or reject pending posts
`media.manage` | write | Upload and manage library assets
`clients.manage` | write | Create and manage clients
`accounts.connect` | write | Generate account connect links
`webhooks.manage` | write | Create and manage webhook endpoints
`webhooks.delete` | write | Delete webhook endpoints
`campaigns.manage` | write | Create and manage campaigns

## Effective permission = scopes ∩ role
A token's power is the intersection of its scopes and the owning member's role. Granting a scope never escalates privilege — if the member can't perform an action, neither can their token, even with the scope. A request to a route whose scope the token lacks returns 403.

## FAQ
**Q: What write access can a token have?**
A: Composing posts (`posts.compose`), managing library assets (`media.manage`), managing webhook endpoints (`webhooks.manage` / `webhooks.delete`), managing clients (`clients.manage`), and minting account connect links (`accounts.connect`). The surface still excludes billing, team, and admin actions, and destructive account/post deletion.