Permissions
Scopes have the form area:read or area:write. If a permission is missing, the API responds with 403 insufficient_scope; the field details.missing lists the missing scopes. The API reference shows the permission each endpoint requires. GET /me returns your current scopes.
All scopes
| Area | Scope | Allows |
|---|---|---|
| Profile and company data | profile:read | Read profile, company and invoicing master data |
| Profile and company data | profile:write | Change profile, company and invoicing master data |
| Contacts | contacts:read | Read contacts (customers/debtors) |
| Contacts | contacts:write | Create, update and delete contacts |
| Clients | clients:read | Read clients (collection agency/law firm) |
| Clients | clients:write | Manage clients |
| Debts | debts:read | Read debts, costs, interest and phases |
| Debts | debts:write | Create and update debts, change phases, trigger dunning letters |
| Payments and instalment plans | payments:read | Read payments and instalment plans |
| Payments and instalment plans | payments:write | Record payments, manage instalment plans |
| Letter dispatch | letters:read | Read letters and delivery status |
| Letter dispatch | letters:write | Send letters (charged) |
| Documents | documents:read | Read files/documents |
| Documents | documents:write | Upload and delete files |
| Invoices | invoices:read | Read invoices and credit notes |
| Invoices | invoices:write | Create, finalise, send and cancel invoices |
| Quotes | offers:read | Read quotes and order confirmations |
| Quotes | offers:write | Create and send quotes |
| Articles | articles:read | Read articles (products/services) |
| Articles | articles:write | Manage articles (products/services) |
| Receipts | receipts:read | Read receipts |
| Receipts | receipts:write | Upload, edit and finalise receipts |
| Bank | banking:read | Read bank accounts and transactions |
| Bank | banking:write | Import and match transactions |
| Projects | projects:read | Read projects |
| Projects | projects:write | Manage projects |
| Time tracking | time:read | Read time entries |
| Time tracking | time:write | Record and change time entries |
| Reports | reports:read | Reports (cash-basis income statement EÜR, advance VAT return) and DATEV export |
| Accounting | accounting:read | Read journal, chart of accounts, accounting settings and period locks |
| Accounting | accounting:write | Manual journal entries, accounting settings, locking periods |
| Webhooks | webhooks:read | Read webhook endpoints and deliveries |
| Webhooks | webhooks:write | Manage webhook endpoints |
| Research (address, residents’ registration office, social media) | research:read | Read address research, residents’ registration office requests and social media profiles |
| Research (address, residents’ registration office, social media) | research:write | Place residents’ registration office requests (charged) and maintain social media profiles |
| Creditor AI | ai:read | Read creditor AI recommendations |
| Creditor AI | ai:write | Generate creditor AI recommendations (limited AI quota) |
| Activity log | activity:read | Read the activity log (history across all objects) |
| Activity log | activity:write | Create your own activity log entries |
Dashboard only
Account management is not tied to any scope and is only possible with a dashboard sign-in: creating and revoking API keys, registering OAuth apps, disconnecting connected apps, passkeys and two-factor sign-in, deleting the account. If an API key or OAuth token attempts this, the API responds with 403 session_required.
Webhooks and scopes
A webhook endpoint only receives events for which the key or app that created it has the matching read scope – for example invoice.paid only with invoices:read. The required scope is listed in the event catalogue on the Webhooks page.