Scopes

API keys carry an explicit list of scopes. Missing a scope returns 403.

Scope	Access
cases:read	List/get cases
cases:write	Create cases, complete wizard, POST /cases/short-term
documents:read	List/get documents and download content
documents:write	Upload documents to a case
people:read	List/get people, including nested permits, certificates, and case summaries

Grant the least privilege your integration needs. Nested permit and certificate data on people requires people:read only — there are no separate permits:* or certificates:* scopes.

Webhooks are managed in Admin → Developers by signed-in users; they are not controlled by API-key scopes.