Scopes

Every access token carries one or more scopes. An endpoint that needs a scope your token doesn’t have returns:

{
  "error": "Forbidden",
  "code": "SCOPE_REQUIRED",
  "message": "This action requires the 'purchase' scope.",
  "required_scope": "purchase"
}

The three scopes

Scope	Unlocks
discovery	Read-only: counts, lookups, segment/audience reads, demographics, the field catalog, and polling job/run status. Nothing here creates or charges anything.
purchase	Read-write: create/update segments and audiences, run microbatch/file matches, link campaigns, and trigger deliveries. This is where billable operations live.
account	Self-service account management: API key creation/revocation, webhook subscriptions, delivery destination settings, and billing/usage reads.

There is no 'admin' scope you can request

admin exists internally but is never issuable to an API key or an OAuth grant — a key request or authorization asking for it is rejected outright. Admin-level actions go through platform staff tooling, not the public API.

Picking scopes for a key

Request the narrowest set your integration actually needs. A read-only reporting integration should carry discovery alone; give it purchase only if it actually creates audiences or triggers deliveries. account is powerful enough (it can mint other API keys) that it’s worth keeping off keys used by anything other than your own account-management tooling.

account is role-gated, not just scope-gated

Even a key with the account scope can’t create or revoke keys unless the caller’s org role is owner or admin — the check happens server-side against your organization’s role table, not just the token’s scope claim. A member-role user’s key requesting account will still 403 on those specific endpoints.

Scopes on OAuth tokens

OAuth-issued tokens (see OAuth) work the same way, with one difference: the scopes available to request are bounded by what the connecting client app is allowed to ask for, not just what the authorizing user could grant. A user can only approve a subset of the client’s allowed scopes — never more.