Scopes

A key or an OAuth connection can only use the tools its scopes open. If a call is refused with forbidden, the key is missing the scope that tool needs: create a new key with it in Console → API keys, or reconnect the assistant and approve the scope.

The authoritative list is the one your API publishes as scopes_supported at /.well-known/oauth-protected-resource. Today it is:

Scope	Lets it
posts:read	Browse posts ("show my scheduled posts")
posts:write	Create and schedule posts
posts:publish	Publish now, or retry a failed post
posts:delete	Delete a post, for good once it runs
analytics:read	Read analytics ("how did we do last month?")
ai:generate	Draft copy and media; uses your AI credits
media:read	Find media in the library
media:write	Import media from a direct https link
integrations:read	See which accounts are connected
channels:read	Read the inbox
channels:write	Reply to a conversation
forms:read	Read forms and their answers
forms:write	Publish or unpublish a form
leads:read	Read leads
leads:write	Update a lead's status
email:read	Read templates, campaigns and audiences
email:write	Save an email template
automations:read	Read automations and their runs
automations:write	Create an automation from a template, turn one on or off
audit:read	Read the API audit log
webhooks:manage	Manage webhooks

Two scopes you grant on purpose

mutate:auto lets a connection's writes run without a person approving them, and proposals:approve lets it approve writes waiting for someone else. They are never advertised to an assistant that asks for "everything", and a consent screen shows them apart and unticked, with posts:delete. Give them only to code you trust to act on its own.