Scopes

Scopes decide which modules and operations a token can reach. Request only what your app needs.

Format

Scalar360.<module>.<operation>

Scalar360.invoices.READ
Scalar360.customers.ALL
Scalar360.fullaccess.ALL

The module is the first path segment after the version: /api/v1/invoices/… needs an invoices scope and /api/crm/leads/… a crm scope. Every endpoint in the API reference shows the exact scope it needs. Separate several scopes with commas. Scope names are case-insensitive.

Users, invitations and settings

Managing team members, invitations, roles and permissions, and changing organisation settings, needs the settings scope — for example Scalar360.settings.READ or Scalar360.settings.ALL. It is never included in Scalar360.fullaccess.ALL, so an app has to ask for it explicitly. Reading the organisations a user belongs to (GET /api/v1/organizations and GET /api/v1/organizations/{id}) works with any scope.

Never available

Some areas can't be reached with any scope: sign-in and accounts (passwords, two-step sign-in, passkeys, sessions), billing, payments and subscriptions, switching or creating organisations, accepting invitations, AI and developer settings, and the employee self-service portal. These return 403 FORBIDDEN_RESOURCE.

A token without the right scope gets 401 INVALID_SCOPE, and the message names the scope required.

All modules