> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reap.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes

> Limit an API key to the endpoints it needs.

Every endpoint requires one scope, and each endpoint's page in this reference names it. An API key either has full access or holds a list of scopes.

* A key with full access can call every endpoint your project has. Keys have full access unless you restrict them.
* A restricted key can call only the endpoints whose scope is on its list.

Restricting keys limits the damage a leaked key can do. A key for a finance team that only downloads statements needs `STATEMENTS_READ` and nothing else, so it cannot issue cards or reveal card details.

> [!NOTE]
>
> Choose a key's scopes in the dashboard when you create it, and change them there at any time. A change applies from the key's next request.

## When a key lacks a scope

A request from a key that does not hold the endpoint's scope fails with `403` and code `INSUFFICIENT_SCOPE`. `detail.requiredScope` names the scope the key needs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.