Scopes & Permissions

One key authenticates every programmatic surface — the REST API, the Synter MCP server, and the CLI. Scopes control what that key is allowed to do: a key can only perform the actions its scopes permit.

Scopes gate actions, connections gate platforms

Scopes are capability-based, not per-platform. campaigns:state lets a key pause a campaign on any platform the workspace has connected — it never grants reach into a platform that is not connected. Which platforms a key can touch is governed by the workspace's connections in Settings → Integrations. With 99 supported platforms, a per-platform scope list would be unusable and would duplicate authorization that already lives in the connection layer.

Presets

When creating a key you can start from a preset and narrow it. At least one scope is required.

Read only (19 scopes) — every read scope, no mutations. Safe for dashboards and CI checks.
Defaults (27 scopes) — a typical operator surface. Excludes money movement, guardrail removal, unattended automation, raw script execution, and outbound.
All (48 scopes) — everything, including the highest-risk scopes. Grant only to a key you fully control.

Legacy keys keep working

Keys issued before granular scopes carry tools:read and tools:write. Those are expanded onto the equivalent granular set, so existing integrations are unaffected. New keys should always carry an explicit selection.

REPORTING

Read performance data from connected ad accounts. No mutations.

Scope	What it permits	Type	In defaults
`reporting:read`	Pull spend, impressions, clicks, conversions, and CPA/ROAS from any connected ad account, including raw query languages (GAQL) and analytics reports Covers: pull_*_performance, list_campaigns, tiktok_ads_get_insights, run_gaql_query, run_gaql, ga4_get_report	read	Yes
`reporting:write`	Create and update saved reports, dashboards, and scheduled report delivery Covers: create_report, auto_report, schedule_report	write	Yes

CAMPAIGNS

Read, plan, create, and change campaign state across connected platforms.

Scope	What it permits	Type	In defaults
`campaigns:read`	View campaigns, ad groups, ads, and their settings Covers: list_campaigns, tiktok_ads_get_ad_groups, get_ad_readback, get_account_changelog	read	Yes
`campaigns:plan`	Create and forecast campaign plans without pushing them to a platform Covers: create_campaign_plan, forecast_campaign, upsert_plan_entity	write	Yes
`campaigns:write`	Create and update live campaigns, ad groups, and ads on connected platforms Covers: execute_campaign_plan, create_campaign_for_audience, tiktok_ads_update_adgroup	write	Yes
`campaigns:state`	Enable and pause campaigns — directly starts or stops ad delivery Covers: enable_campaign, pause_campaign	write	Yes
`campaigns:structure`	Audit and repair account structure Covers: audit_account_structure, repair_account_structure	write	Opt-in

BUDGET & AUTOMATION

Move money and run unattended automation. The highest-risk group.

Scope	What it permits	Type	In defaults
`budget:write`	Change campaign budgets and reallocate spend across platforms Covers: update_campaign_budget, optimize_budget	write	Opt-in
`guardrails:write`	Set, disable, and remove spend guardrails and spend alerts — can remove a safety limit Covers: set_campaign_guardrail, disable_campaign_guardrail, set_spend_alert	write	Opt-in
`automation:read`	View configured autonomous schedules and their run history Covers: list_autonomous_schedules	read	Yes
`automation:write`	Create unattended autonomous schedules that act on the account without a human in the loop Covers: create_autonomous_schedule, list_autonomous_schedules	write	Opt-in
`scripts:execute`	Execute platform mutation scripts directly, bypassing higher-level tools Covers: execute, run_ppc_script, inspect_script	write	Opt-in
`budget:read`	View budgets, bid settings, pacing, and daily spend Covers: get_account_daily_spend, analyze_cpc_trends	read	Yes
`guardrails:read`	View configured spend guardrails and alerts Covers: list_campaign_guardrails	read	Yes

AUDIENCES

Build, sync, and remove targeting audiences.

Scope	What it permits	Type	In defaults
`audiences:read`	List audiences and discover audience signals Covers: list_audiences, find_audience_signals	read	Yes
`audiences:write`	Build, attach, sync, and delete audiences on ad platforms Covers: build_abm_audience, build_lookalike_audience, sync_audience, attach_audience, delete_audience	write	Yes

CREATIVE

Generate and manage ad creative. Generation consumes credits.

Scope	What it permits	Type	In defaults
`creative:read`	List creative assets and review results Covers: list_creative_assets, test_creatives	read	Yes
`creative:generate`	Generate images, video, voice, and ad copy — consumes workspace credits Covers: create_image_asset, create_video_ad, create_ad_copy, generate_ugc_ad, generate_voice_ad	write	Yes
`creative:publish`	Upload creative to ad platforms and attach it to live ads Covers: upload_creative, meta_ads_create_ad, reddit_ads_create_ad	write	Yes

LANDING PAGES

Create, edit, and publish landing pages and custom domains.

Scope	What it permits	Type	In defaults
`landing_pages:write`	Create and edit landing pages Covers: create_landing_page, update_landing_page_html, update_landing_page_tracking, create_landing_page_replica, create_verified_page_replica, update_verified_page_replica	write	Yes
`landing_pages:publish`	Publish landing pages to a public URL and configure custom domains Covers: publish_landing_page, setup_custom_domain, verify_custom_domain	write	Opt-in
`landing_pages:read`	View landing pages and their published status Covers: get_competitor_landing_pages, fetch_website_report	read	Yes

TRACKING & TAGS

Read and change pixels, conversion tracking, and GTM containers.

Scope	What it permits	Type	In defaults
`tracking:read`	View pixels, conversion tracking, and GTM containers/tags Covers: get_pixel_destinations, list_gtm_tags, list_gtm_containers	read	Yes
`tracking:write`	Configure pixels and edit/publish GTM containers — changes live site tracking Covers: configure_pixel_destination, update_gtm_tag, publish_gtm_container	write	Opt-in

MEASUREMENT

Attribution, incrementality, and cross-platform reconciliation.

Scope	What it permits	Type	In defaults
`measurement:read`	Read attribution, incrementality results, and cross-platform reconciliation Covers: get_attribution, measure_incrementality, get_spend_reconciliation	read	Yes
`measurement:write`	Configure attribution models and start incrementality/holdout tests Covers: measure_incrementality, mmm_get_projections	write	Opt-in

CONNECTIONS

View and manage platform connections for the workspace.

Scope	What it permits	Type	In defaults
`connections:read`	View which platforms are connected and their health status Covers: get_connection_status, list_connected_accounts, verify_platform_accounts	read	Yes
`connections:write`	Connect and disconnect platform accounts for the workspace — can cut off data collection Covers: connect_platform, disconnect_platform	write	Opt-in
`accounts:write`	Provision new child ad accounts under the workspace's manager account Covers: create_child_account, google_ads_create_customer_account	write	Opt-in

WORKSPACE

Documents, skills, memory, and workspace configuration the agent reads.

Scope	What it permits	Type	In defaults
`workspace:read`	Read workspace documents, skills, brand context, and agent memory Covers: list_skills, load_skill, get_plugin_info, get_campaign_plan	read	Yes
`workspace:write`	Create and delete workspace documents and reports Covers: create_document, delete_document, publish_plan_document	write	Yes
`workspace:external_docs`	Read and write Google Docs, Sheets, and Drive files in the connected Google account Covers: create_google_doc, create_google_sheet, read_google_sheet, update_google_sheet	write	Opt-in
`workspace:notify`	Send messages to connected Slack channels Covers: send_slack_message	write	Opt-in
`workspace:code`	Push generated code and assets to a connected GitHub repository Covers: publish_to_github	write	Opt-in

GROWTH & OUTBOUND

Prospecting, enrichment, and outbound sequences. Can contact real people.

Scope	What it permits	Type	In defaults
`growth:read`	Run company/contact discovery and firmographic enrichment Covers: growth_discover, growth_enrich, builtwith_get_domain_technologies	read	Opt-in
`growth:write`	Run outbound pipelines that can contact real people — enable deliberately Covers: growth_run_pipeline	write	Opt-in

BILLING

Credit balance and spend visibility.

Scope	What it permits	Type	In defaults
`billing:read`	View credit balance and workspace spend Covers: get_credit_balance, get_billing_status, forecast_tool_cost, forecast_campaign_fee	read	Yes

COMMERCE

Shopify, Merchant Center, product feeds, catalogs, and discounts.

Scope	What it permits	Type	In defaults
`commerce:read`	Read products, orders, catalogs, and Merchant Center feed status Covers: shopify_get_products, google_merchant_get_feed_status	read	Yes
`commerce:write`	Create and update products, discounts, catalogs, and product feeds — changes a live storefront Covers: shopify_create_discount, meta_ads_create_product_catalog, google_merchant_submit_feed	write	Opt-in

EMAIL

Klaviyo and Loops email/SMS campaigns, flows, and templates.

Scope	What it permits	Type	In defaults
`email:read`	Read email/SMS campaigns, flows, templates, and engagement Covers: klaviyo_get_templates, get_email_engagers	read	Yes
`email:write`	Create and send email/SMS campaigns and flows — can send to real subscribers Covers: klaviyo_create_campaign, loops_send_event	write	Opt-in

ORGANIC SOCIAL

Publish organic posts, replies, and DMs from connected profiles. Posts publicly under the customer's identity.

Scope	What it permits	Type	In defaults
`social:read`	Read organic posts, engagement, and follower data Covers: x_get_mentions, linkedin_list_posts	read	Yes
`social:write`	Publish organic posts, replies, and DMs under the customer's own identity — publicly visible Covers: publish_organic_post, linkedin_post_content, x_quote_retweet	write	Opt-in

COMPETITIVE INTELLIGENCE

Competitor, market, keyword, and AI-search-visibility research.

Scope	What it permits	Type	In defaults
`intel:read`	Run competitor, keyword, market, and AI-search-visibility research Covers: scrape_meta_ads_library, benchmark_ppc_budgets_spyfu, ask_gauge	read	Yes
`intel:write`	Create and update tracked competitors, prompts, and research projects Covers: gauge_create_prompts, add_competitor	write	Opt-in

EVENTS

Luma events, webinars, and guest lists.

Scope	What it permits	Type	In defaults
`events:read`	Read events, webinars, and guest lists Covers: luma_get_events, luma_get_guests	read	Yes
`events:write`	Create events and add guests — can email real attendees on the platform's behalf Covers: luma_create_event, luma_update_event, luma_create_image, luma_create_guests	write	Opt-in

CODE & ENGINEERING

Generate and ship code, open pull requests, and run build pipelines. The most privileged group.

Scope	What it permits	Type	In defaults
`engineer:write`	Generate and push code, open pull requests, and run build/validation pipelines Covers: engineer_build_feature, create_engineer_run, engineer_rerun	write	Opt-in

Legacy scopes

Every key issued before the granular model carries both of these. They continue to work; the scopes above supersede them.

Scope	What it permits
`tools:read`	Legacy: read access to every read-only tool and endpoint. Superseded by the granular read scopes below.
`tools:write`	Legacy: write access to every mutating tool and endpoint. Superseded by the granular write scopes below.

Denied requests

A request the key is not scoped for returns 403 with the missing scope named, so you can add exactly what is needed:

{
  "error": "Insufficient permissions",
  "message": "Insufficient permissions: 'update_campaign_budget' requires the 'budget:write' scope.",
  "required_scope": "budget:write"
}

PreviousTool Reference

Was this page helpful?