Permission scopes
Every scope a key, role or token can hold, what it allows, and the defaults each key kind gets.
Every API route and MCP tool checks one scope against the space it acts on. The scopes and the per-kind defaults below are generated from the same definitions the API checks against.
Scopes
Section titled “Scopes”| Scope | Allows |
|---|---|
content:write | Create and edit draft entries and assets, comment, create tasks, and run AI drafting on entries. |
content:publish | Publish and unpublish entries, assets, content types and releases; schedule publishing; permanently delete trashed entries. |
content:manage | Define and change content types, workflows, taxonomy, functions, app extensions and AI actions. |
delivery:read | Read published entries and assets, including GraphQL and the live stream. |
preview:read | Read draft and current entries, content types, releases and workflows. |
search:read | Search published content (hybrid, semantic and lexical) and find related entries. |
space:admin | Manage the team, API keys, roles, environments and aliases, webhooks, the audit log and agent runs. |
workflow:approve | Decide workflow approvals that ask for it (the default). |
Defaults per key kind
Section titled “Defaults per key kind”A key gets its kind’s scopes unless it is minted with an explicit, narrower list or bound to a role.
| Kind | For | Scopes |
|---|---|---|
cma Management (CMA) | Authoring, publishing and administration | content:write, content:publish, content:manage, delivery:read, preview:read, search:read, space:admin, workflow:approve |
cpa Preview (CPA) | Draft content for previews and staging sites | preview:read, delivery:read, search:read |
cda Delivery (CDA) | Published content for production sites and apps | delivery:read, search:read |
Narrowing further
Section titled “Narrowing further”- The built-in roles (Viewer, Approver, Editor, Manager, Administrator) are named scope sets, each including the one before it.
- A role adds per-content-type grants (
read,write,publish) and per-field rules (denied or read-only) on top of scopes. - A personal access token or an OAuth token never exceeds the person it acts for: its scopes are the intersection of what it was granted and what that person’s role allows now.
- A workflow stage or approval names the scope needed to move an entry into it or decide it.