Permissions
Read-only and full access, owner and editor roles, and approvals.
What a request may do is the smaller of two things: the credential’s scope and the member’s role.
Scopes
Section titled “Scopes”| Scope | Allows |
|---|---|
read |
Every GET, plus POST /posts/validate. MCP clients see only read tools. |
write |
Everything read allows, plus creating, changing, publishing and deleting content, uploading media, answering comments and messages, and managing tags, queue slots and webhooks. |
A read-only credential that tries to change something gets 403 FORBIDDEN (This key can only read…).
GET /me returns the credential’s scope as credential.scope. Each operation in the API reference is tagged
x-scope: read or write.
API keys act as the owner who created them. OAuth tokens act as the member who approved the app, who may be an editor.
| Action | Owner | Editor |
|---|---|---|
| Read, draft and validate posts | ✓ | ✓ |
| Schedule and publish | ✓ | ✓, unless the workspace requires approval |
| Approve or reject posts sent for review | ✓ | |
| Manage webhooks | ✓ | |
| Answer comments and messages | ✓ | ✓ |
Approval workflows
Section titled “Approval workflows”When the workspace requires the owner’s approval (workspace.approvalRequired in /me), editors send posts with
action: "submit". They wait with review: "pending" until the owner approves or
rejects them. See Approvals.
Writing needs an active subscription or trial; reading always works. Plan limits (accounts, posts a month, storage)
apply to the API exactly as in the app and return 402 PLAN_LIMIT.