Permissions and scopes

Each key has explicit scopes. Ask for the smallest set your integration needs. Read, write and delete permissions are separate. Having a write scope does not implicitly grant read or delete access. A valid key missing any required scope receives 403.

Required permissions

The following table is generated from the same registered-route inventory as the public specification. Each operation exposes its complete set as x-required-scopes in the OpenAPI document.

Scope	Operations requiring it
`analytics.future-profit.read`	`GET /open/crm/v1/analytics/future-profit` `GET /open/crm/v1/analytics/future-profit/period`
`booking.availability.read`	`GET /open/crm/v1/booking/available-dates` `GET /open/crm/v1/booking/time-slots`
`clients.delete`	`DELETE /open/crm/v1/clients/{clientId}`
`clients.read`	`GET /open/crm/v1/clients` `GET /open/crm/v1/clients/{clientId}`
`clients.write`	`POST /open/crm/v1/clients` `PUT /open/crm/v1/clients/{clientId}`
`employees.free-windows.read`	`GET /open/crm/v1/employees/free-windows` `GET /open/crm/v1/employees/free-windows/{free_window}`
`employees.read`	`GET /open/crm/v1/employees` `GET /open/crm/v1/employees/{employeeID}` `GET /open/crm/v1/employees/{employeeID}/services`
`schedules.delete`	`DELETE /open/crm/v1/schedules/{scheduleId}`
`schedules.read`	`GET /open/crm/v1/schedules` `GET /open/crm/v1/schedules/{scheduleId}`
`schedules.write`	`POST /open/crm/v1/schedules` `PUT /open/crm/v1/schedules/{scheduleId}` `POST /open/crm/v1/schedules/bulk`
`service-categories.delete`	`DELETE /open/crm/v1/service-categories/{categoryID}`
`service-categories.read`	`GET /open/crm/v1/service-categories` `GET /open/crm/v1/service-categories/{categoryID}` `GET /open/crm/v1/service-categories/{categoryID}/verify-delete`
`service-categories.write`	`POST /open/crm/v1/service-categories` `PUT /open/crm/v1/service-categories/{categoryID}` `PATCH /open/crm/v1/service-categories/{categoryID}` `POST /open/crm/v1/service-categories/bulk` `PUT /open/crm/v1/service-categories/sortable` `PUT /open/crm/v1/service-categories/{categoryID}/hide`
`services.delete`	`DELETE /open/crm/v1/services/{serviceID}`
`services.read`	`GET /open/crm/v1/employees/{employeeID}/services` `GET /open/crm/v1/service-categories/{categoryID}/services` `GET /open/crm/v1/services` `GET /open/crm/v1/services/{serviceID}` `GET /open/crm/v1/services/{serviceID}/verify-delete`
`services.write`	`POST /open/crm/v1/services` `PUT /open/crm/v1/services/{serviceID}` `PATCH /open/crm/v1/services/{serviceID}` `POST /open/crm/v1/services/bulk` `PUT /open/crm/v1/services/sortable` `POST /open/crm/v1/services/photos/upload-url` `DELETE /open/crm/v1/services/photos/upload`
`visits.read`	`GET /open/crm/v1/visits` `GET /open/crm/v1/visits/{visitID}` `GET /open/crm/v1/visits/repeats`
`visits.write`	`POST /open/crm/v1/booking/visits` `POST /open/crm/v1/visits` `PUT /open/crm/v1/visits/{visitID}` `PUT /open/crm/v1/visits/{visitID}/status` `POST /open/crm/v1/visits/{visitID}/cancel`

Combined scopes

GET /open/crm/v1/employees/{employeeID}/services requires both employees.read and services.read. Either missing scope returns 403. employees.free-windows.read grants availability access separately from the employee directory. booking.availability.read and analytics.future-profit.read also grant only their documented operations.

Updating an integration

New scopes are not automatically added to previously issued keys. Ask the owner to issue a key with the new grants when adopting another feature. Scopes do not expand the profile boundary: a key cannot read another profile's objects even when it has the corresponding resource scope.