Scopes

Scopes limit which API operations a key can call.

Scope	Allows
`invoices:write`	Uploading invoices and attachments through `POST /v1/invoices/upload`
`invoices:read`	Listing invoices and reading an invoice’s processing and assessment state

New integration keys receive both invoice scopes. The required scope is also declared on every generated endpoint page.

Missing scope

An authenticated key without the required permission receives 403 Forbidden with the error code insufficient_scope.

{
  "error": {
    "code": "insufficient_scope",
    "message": "Token lacks required scope",
    "description": "Required scope: invoices:write",
    "request_id": "..."
  }
}

Do not treat 403 as an authentication retry. Create a replacement key, update the integration to use it, and then revoke the old key.

⌘I

Start here

Work with invoices

Operations

Endpoints

Missing scope

​Missing scope

Missing scope