# Permissions

What a request may do is the smaller of two things: the credential's **scope** and the member's **role**.

## Scopes

| Scope | Allows |
|---|---|
| `read` | Every `GET`, plus [`POST /posts/validate`](/api/operations/validatepost/). MCP clients see only read tools. |
| `write` | Everything `read` allows, plus creating, changing, publishing and deleting content, uploading media, answering comments and messages, and managing tags, queue slots and webhooks. |

A read-only credential that tries to change something gets `403 FORBIDDEN` (`This key can only read…`).
`GET /me` returns the credential's scope as `credential.scope`. Each operation in the [API reference](/api/) is tagged
`x-scope: read` or `write`.

## Roles

API keys act as the owner who created them. OAuth tokens act as the member who approved the app, who may be an editor.

| Action | Owner | Editor |
|---|---|---|
| Read, draft and validate posts | ✓ | ✓ |
| Schedule and publish | ✓ | ✓, unless the workspace requires approval |
| Approve or reject posts sent for review | ✓ | |
| Manage webhooks | ✓ | |
| Answer comments and messages | ✓ | ✓ |

## Approval workflows

When the workspace requires the owner's approval (`workspace.approvalRequired` in `/me`), editors send posts with
`action: "submit"`. They wait with `review: "pending"` until the owner [approves](/api/operations/approvepost/) or
[rejects](/api/operations/rejectpost/) them. See [Approvals](/guides/approvals/).

## Plans

Writing needs an active subscription or trial; reading always works. Plan limits (accounts, posts a month, storage)
apply to the API exactly as in the app and return `402 PLAN_LIMIT`.