Scopes - Codaclean API

Each API key is granted a set of scopes by Codaclean. Every endpoint requires one scope, shown on its reference page. A call without the required scope returns 403 with the code forbiddenScope.

Scope	Allows
`customers:read`	Search and read customers, list banks and payroll providers.
`customers:write`	Create and update customers, add bank accounts and payroll providers.
`customers:delete`	Archive customers, disable bank accounts, remove payroll providers.
`mandates:read`	Search and read mandates.
`mandates:write`	Request CODA and CODB mandates.
`files:read`	List CODA and CODB files and acknowledge their download.
`files:write`	Get credentials to upload CODA and CODB files.

Default scopes

Unless Codaclean configured otherwise, an API key has the read scopes only: customers:read, mandates:read and files:read. Write and delete scopes are always granted explicitly. To get more scopes, contact Codaclean.

Restrictions by the accounting firm

An accounting firm can restrict the scopes your API key has for its own data. It can only narrow them, never extend them. A scope removed by the firm returns forbiddenScope for that firm’s users only.

Scope changes take effect within about a minute.

Endpoints without a scope

POST /token and GET /hello do not require any scope.