Scopes

Scopes keep integrations focused. Choose the smallest set that completes the job.

Scope	Use it for
discovery	Exploring counts, fields, segments, audiences, and workflow status; some operations run data queries or update cached state, but do not purchase records
creator	Creating or changing segments and audiences, resolving records, enriching data, and delivering results; these operations may incur billable usage
account	Managing API keys, webhooks, destinations, billing, and usage settings

A token without the required scope receives a 403 response that names the scope to add:

{
  "error": "Forbidden",
  "code": "SCOPE_REQUIRED",
  "message": "This action requires the 'creator' scope.",
  "required_scope": "creator"
}

Keep account for trusted account-management services. Creating and revoking keys also requires the caller to be an organization owner or admin.

OAuth connections can request only the scopes approved for that client. When both OAuth scopes are requested, consent starts with discovery selected; the customer must explicitly select creator. discovery is narrower than creator, but not purely read-only: some tools run backend queries or refresh cached state. Those compute counters are operational telemetry, not a customer billing ledger. Reconnecting later can replace the grant with a broader one.

OAuth never issues account or admin. MCP tool safety annotations help compatible clients distinguish read-only operations, but the API always enforces scopes server-side; annotations are guidance, not authorization.