# Choose PAT scopes

> Grant a CLI or AI agent only the Management API permissions it needs.

Canonical page: https://rpc.aurpay.net/docs/management-api/scopes

Each Management API operation requires one or more scopes. Start with the smallest set that covers the client's workflow.

| Resource | Read | Write | Additional sensitive scope |
| --- | --- | --- | --- |
| Overview | `overview:read` | — | — |
| Apps | `apps:read` | `apps:write` | `app-keys:read`, `app-keys:write` |
| Gateways | `gateways:read` | `gateways:write` | — |
| Endpoints | `endpoints:read` | `endpoints:write` | `endpoint-secrets:read` |
| Providers | `providers:read` | `providers:write` | — |
| Routes | `routes:read` | `routes:write` | — |
| Usage | `usage:read` | — | — |
| Metadata | `meta:read` | — | — |
| Accounts | `accounts:read` | `accounts:write` | Admin only |
| Rate-limit policies | `policies:read` | `policies:write` | Admin only |

## Workflow scope combinations

| Workflow | Required scopes |
| --- | --- |
| Inspect Provider deletion impact | `providers:read` |
| List or inspect Provider sync runs | `providers:read` |
| Start a Provider sync | `providers:write` |
| Start a Provider sync and poll its run to completion | `providers:write` and `providers:read` |
| Set or clear an App Provider | `apps:write` and `routes:write` |

Grant every scope listed for a combined workflow. A client that starts a Provider sync and then polls the persistent sync run typically uses both Provider scopes.

Use `endpoint-secrets:read` to receive effective URLs in Endpoint detail responses. Provider credential reveal is a dashboard-only operation authenticated by the dashboard session. Creating or rotating an App API Key returns the newly issued Key, while listing existing Keys requires `app-keys:read`.

The [OpenAPI contract](https://rpc.aurpay.net/openapi/v2.json) exposes the required scopes for each operation through `x-required-pat-scopes`.