Authorization and Scopes
Scope checks are enforced per endpoint.
Available Scopes
| Scope | Company keys | Agency keys | Covers |
|---|---|---|---|
read:companies | Yes | Yes | company list and competency matrix; company-scoped keys also cover company detail, regions, sectors, connected agencies, and company umbrellas |
read:users | Yes | No | user project assignments and effective project permissions |
read:trades | Yes | Yes | trades and trade detail; agency-scoped keys can access trade detail only |
read:rates | Yes | Yes | standalone rates |
read:projects | Yes | No | projects and project connected agencies |
read:workers | Yes | Yes | workers and worker document detail |
write:workers | Yes | Yes | Agency keys can create and update workers; company keys can validate worker attachment and right-to-work documents |
read:purchase-orders | Yes | No | purchase orders |
read:sites | Yes | Yes | site access, including agency access where permitted |
read:requisitions | Yes | Yes | requisitions |
read:assignments | Yes | Yes | assignments |
read:timesheets | Yes | Yes | timesheets and expenses |
read:invoices | Yes | Yes | invoices, AfP, and payment notices |
read:credit-notes | Yes | Yes | credit notes |
No broad super-key behavior is granted by default.
User assignment and permission access requires read:users. Existing keys with only read:companies must be updated to grant this scope. Agency-scoped keys cannot be granted read:users.
Listing default RBAC access rule mappings requires a valid company-scoped key, with no resource scope required. Agency-scoped keys cannot access this endpoint.