API key scopes and permissions

Every API key carries a set of scopes that decide what it can do. Scopes are organized into Feature Groups, and for each group you grant Read, Write, or both. You set these when you generate or edit a key — see Generate and manage API keys for the full workflow.

The scope model

Scopes are grouped by feature area. In the Generate an API Key and Edit your API Key drawers, each feature group is one row you can grant or leave off:

Control	What it does
Feature Groups	The list of feature areas you can scope the key to.
Per-group grant	Grant the group, which gives the key that group's access — labeled Read and Write, Read Only, or Write Only depending on what the group carries.
None	Leave the group off. This is the default for every group.
Select all / Deselect all	Grant or clear every group at once.

Note

The grant for a group is all-or-nothing — you either give the key that group's access as shown, or leave it off. The Read and Write / Read Only / Write Only label describes what a group inherently carries; it is not a separate per-group toggle between reading and writing.

Multi-organization keys

A key can apply to more than one organization. When it does, the same feature- group scopes apply to every organization you selected — you don't scope each organization separately.

Which groups you'll see

Important

The exact set of feature groups is defined by Nash and depends on your organization, so the groups you see may differ from another org's. Grant only the groups a key actually needs. If you expect a group that isn't listed, reach out to Nash.

Related

• Generate and manage API keys — where you set these scopes when creating or editing a key.
• Nash developer docs — how each scope maps to the endpoints you call.