> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codaclean.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes

> Scopes define what your API key is allowed to do.

Each API key is granted a set of scopes by Codaclean.

Every endpoint requires one scope, shown on its reference page. A call without the required scope returns `403` with the code `forbiddenScope`.

| Scope              | Allows                                                                |
| ------------------ | --------------------------------------------------------------------- |
| `customers:read`   | Search and read customers, list banks and payroll providers.          |
| `customers:write`  | Create and update customers, add bank accounts and payroll providers. |
| `customers:delete` | Archive customers, disable bank accounts, remove payroll providers.   |
| `mandates:read`    | Search and read mandates.                                             |
| `mandates:write`   | Request CODA and CODB mandates.                                       |
| `files:read`       | List CODA and CODB files and acknowledge their download.              |
| `files:write`      | Get credentials to upload CODA and CODB files.                        |

## Default scopes

Unless Codaclean configured otherwise, an API key has the read scopes only: `customers:read`, `mandates:read` and `files:read`. Write and delete scopes are always granted explicitly.

To get more scopes, [contact Codaclean](https://codaclean.be/fr-be/contact).

## Restrictions by the accounting firm

An accounting firm can restrict the scopes your API key has for its own data. It can only narrow them, never extend them.

A scope removed by the firm returns `forbiddenScope` for that firm's users only.

<Note>
  Scope changes take effect within about a minute.
</Note>

## Endpoints without a scope

`POST /token` and `GET /hello` do not require any scope.