> ## Documentation Index > Fetch the complete documentation index at: https://docs.pineyard.ai/llms.txt > Use this file to discover all available pages before exploring further. # Scopes a key can be given, with whether the caller may grant each one. > Every scope an API key can hold, grouped by feature (`features[].actions[]`). Scopes a key can never have (`api_keys.edit`, `api_keys.delete`, `team.manage`, `workspace.edit`, `billing.recharge`, `result_webhooks.edit`, `workflows.edit`, `functions.edit`) are omitted entirely, and so is any feature that would be left with no actions. For each action, `key` is the scope name. `grantable` is `true` when the caller's own effective permissions include the scope; for a key, that is the key's own permissions (its scopes intersected with its owner's role), and a key can never create or edit keys anyway. `implies` lists the other scopes automatically included with this one: `edit` and `delete` imply the feature's `view`, plus the special cases listed on [Scopes & permissions](/concepts/scopes#how-scopes-combine) (for example `calls.test` ⇒ `calls.view`, `agents.view`). `billed` is `true` for the scopes whose use spends credits: `calls.test`, `speech.upload` and `whatsapp.send`. `kind` (`view`, `edit`, `delete` or `special`), `label` and `hint` (present only on some `special` scopes) are display text, as are the feature's `label`, `group` and optional `description`. **Required scope:** `api_keys.view` ## OpenAPI ````yaml /api-reference/openapi.json get /api-keys/scopes openapi: 3.0.3 info: title: Pineyard API version: 1.0.0 description: >- Programmatic access to agents, campaigns, calls, phone numbers and results in your Pineyard workspace. servers: - url: https://api.pineyard.ai description: Production security: - bearerAuth: [] paths: /api-keys/scopes: get: summary: Scopes a key can be given, with whether the caller may grant each one. description: >- Every scope an API key can hold, grouped by feature (`features[].actions[]`). Scopes a key can never have (`api_keys.edit`, `api_keys.delete`, `team.manage`, `workspace.edit`, `billing.recharge`, `result_webhooks.edit`, `workflows.edit`, `functions.edit`) are omitted entirely, and so is any feature that would be left with no actions. For each action, `key` is the scope name. `grantable` is `true` when the caller's own effective permissions include the scope; for a key, that is the key's own permissions (its scopes intersected with its owner's role), and a key can never create or edit keys anyway. `implies` lists the other scopes automatically included with this one: `edit` and `delete` imply the feature's `view`, plus the special cases listed on [Scopes & permissions](/concepts/scopes#how-scopes-combine) (for example `calls.test` ⇒ `calls.view`, `agents.view`). `billed` is `true` for the scopes whose use spends credits: `calls.test`, `speech.upload` and `whatsapp.send`. `kind` (`view`, `edit`, `delete` or `special`), `label` and `hint` (present only on some `special` scopes) are display text, as are the feature's `label`, `group` and optional `description`. responses: '200': description: Catalog content: application/json: schema: type: object properties: features: type: array items: type: object properties: key: type: string label: type: string group: type: string description: type: string actions: type: array items: type: object properties: key: type: string kind: type: string label: type: string hint: type: string grantable: type: boolean implies: type: array items: type: string billed: type: boolean required: - key - kind - label - grantable - implies - billed required: - key - label - group - actions required: - features '400': description: >- - `internal_error`: An unexpected error. A `400` with this code usually means the body is not valid JSON; a `413` means the body is larger than 1 MB. - `invalid_body`: The request body (or query) failed validation. Details are in `issues` (or `detail`). `422` on `POST /v1/campaigns/{campaignId}/leads`. '401': description: >- - `invalid_api_key`: The API key is unknown, revoked or expired, or its workspace was deleted. - `unauthorized`: No `Authorization: Bearer` header, or an empty token. '403': description: >- - `api_key_not_scoped`: A key issued without scopes was used outside `/v1`. - `api_key_owner_inactive`: The member the key acts for was removed or suspended. - `forbidden`: The key lacks the permission named in `requiredPermission`, or the resource belongs to another workspace. - `workspace_pending_approval`: The workspace has not been approved yet. - `workspace_suspended`: The workspace is suspended. '413': description: >- - `internal_error`: An unexpected error. A `400` with this code usually means the body is not valid JSON; a `413` means the body is larger than 1 MB. '429': description: '- `rate_limited`: Too many requests.' '500': description: >- - `internal_error`: An unexpected error. A `400` with this code usually means the body is not valid JSON; a `413` means the body is larger than 1 MB. '502': description: >- - `provider_error`: The calling service rejected the request (`upstreamStatus` 4xx) or was unavailable (5xx). '503': description: '- `database_unavailable`: The service is temporarily unavailable.' components: securitySchemes: bearerAuth: type: http scheme: bearer description: Your API key, e.g. `pk_live_xxxxxxxxxxxxxxxxxxxxxxxx`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.