# Scopes & Permissions

One key authenticates every programmatic surface — the REST API, the Synter MCP server, and the CLI. Scopes control what that key is allowed to do: a key can only perform the actions its scopes permit.

Scopes gate actions, connections gate platforms

Scopes are capability-based, not per-platform. `campaigns:state` lets a key pause a campaign on _any_ platform the workspace has connected — it never grants reach into a platform that is not connected. Which platforms a key can touch is governed by the workspace's connections in Settings → Integrations. With 99 supported platforms, a per-platform scope list would be unusable and would duplicate authorization that already lives in the connection layer.

## Presets

When creating a key you can start from a preset and narrow it. At least one scope is required.

-   **Read only** (19 scopes) — every read scope, no mutations. Safe for dashboards and CI checks.
-   **Defaults** (27 scopes) — a typical operator surface. Excludes money movement, guardrail removal, unattended automation, raw script execution, and outbound.
-   **All** (48 scopes) — everything, including the highest-risk scopes. Grant only to a key you fully control.

Legacy keys keep working

Keys issued before granular scopes carry `tools:read` and `tools:write`. Those are expanded onto the equivalent granular set, so existing integrations are unaffected. New keys should always carry an explicit selection.

## REPORTING

Read performance data from connected ad accounts. No mutations.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| reporting:read | Pull spend, impressions, clicks, conversions, and CPA/ROAS from any connected ad account, including raw query languages (GAQL) and analytics reportsCovers: pull_*_performance, list_campaigns, tiktok_ads_get_insights, run_gaql_query, run_gaql, ga4_get_report | read | Yes |
| reporting:write | Create and update saved reports, dashboards, and scheduled report deliveryCovers: create_report, auto_report, schedule_report | write | Yes |

## CAMPAIGNS

Read, plan, create, and change campaign state across connected platforms.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| campaigns:read | View campaigns, ad groups, ads, and their settingsCovers: list_campaigns, tiktok_ads_get_ad_groups, get_ad_readback, get_account_changelog | read | Yes |
| campaigns:plan | Create and forecast campaign plans without pushing them to a platformCovers: create_campaign_plan, forecast_campaign, upsert_plan_entity | write | Yes |
| campaigns:write | Create and update live campaigns, ad groups, and ads on connected platformsCovers: execute_campaign_plan, create_campaign_for_audience, tiktok_ads_update_adgroup | write | Yes |
| campaigns:state | Enable and pause campaigns — directly starts or stops ad deliveryCovers: enable_campaign, pause_campaign | write | Yes |
| campaigns:structure | Audit and repair account structureCovers: audit_account_structure, repair_account_structure | write | Opt-in |

## BUDGET & AUTOMATION

Move money and run unattended automation. The highest-risk group.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| budget:write | Change campaign budgets and reallocate spend across platformsCovers: update_campaign_budget, optimize_budget | write | Opt-in |
| guardrails:write | Set, disable, and remove spend guardrails and spend alerts — can remove a safety limitCovers: set_campaign_guardrail, disable_campaign_guardrail, set_spend_alert | write | Opt-in |
| automation:read | View configured autonomous schedules and their run historyCovers: list_autonomous_schedules | read | Yes |
| automation:write | Create unattended autonomous schedules that act on the account without a human in the loopCovers: create_autonomous_schedule, list_autonomous_schedules | write | Opt-in |
| scripts:execute | Execute platform mutation scripts directly, bypassing higher-level toolsCovers: execute, run_ppc_script, inspect_script | write | Opt-in |
| budget:read | View budgets, bid settings, pacing, and daily spendCovers: get_account_daily_spend, analyze_cpc_trends | read | Yes |
| guardrails:read | View configured spend guardrails and alertsCovers: list_campaign_guardrails | read | Yes |

## AUDIENCES

Build, sync, and remove targeting audiences.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| audiences:read | List audiences and discover audience signalsCovers: list_audiences, find_audience_signals | read | Yes |
| audiences:write | Build, attach, sync, and delete audiences on ad platformsCovers: build_abm_audience, build_lookalike_audience, sync_audience, attach_audience, delete_audience | write | Yes |

## CREATIVE

Generate and manage ad creative. Generation consumes credits.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| creative:read | List creative assets and review resultsCovers: list_creative_assets, test_creatives | read | Yes |
| creative:generate | Generate images, video, voice, and ad copy — consumes workspace creditsCovers: create_image_asset, create_video_ad, create_ad_copy, generate_ugc_ad, generate_voice_ad | write | Yes |
| creative:publish | Upload creative to ad platforms and attach it to live adsCovers: upload_creative, meta_ads_create_ad, reddit_ads_create_ad | write | Yes |

## LANDING PAGES

Create, edit, and publish landing pages and custom domains.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| landing_pages:write | Create and edit landing pagesCovers: create_landing_page, update_landing_page_html, update_landing_page_tracking, create_landing_page_replica, create_verified_page_replica, update_verified_page_replica | write | Yes |
| landing_pages:publish | Publish landing pages to a public URL and configure custom domainsCovers: publish_landing_page, setup_custom_domain, verify_custom_domain | write | Opt-in |
| landing_pages:read | View landing pages and their published statusCovers: get_competitor_landing_pages, fetch_website_report | read | Yes |

## TRACKING & TAGS

Read and change pixels, conversion tracking, and GTM containers.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| tracking:read | View pixels, conversion tracking, and GTM containers/tagsCovers: get_pixel_destinations, list_gtm_tags, list_gtm_containers | read | Yes |
| tracking:write | Configure pixels and edit/publish GTM containers — changes live site trackingCovers: configure_pixel_destination, update_gtm_tag, publish_gtm_container | write | Opt-in |

## MEASUREMENT

Attribution, incrementality, and cross-platform reconciliation.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| measurement:read | Read attribution, incrementality results, and cross-platform reconciliationCovers: get_attribution, measure_incrementality, get_spend_reconciliation | read | Yes |
| measurement:write | Configure attribution models and start incrementality/holdout testsCovers: measure_incrementality, mmm_get_projections | write | Opt-in |

## CONNECTIONS

View and manage platform connections for the workspace.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| connections:read | View which platforms are connected and their health statusCovers: get_connection_status, list_connected_accounts, verify_platform_accounts | read | Yes |
| connections:write | Connect and disconnect platform accounts for the workspace — can cut off data collectionCovers: connect_platform, disconnect_platform | write | Opt-in |
| accounts:write | Provision new child ad accounts under the workspace's manager accountCovers: create_child_account, google_ads_create_customer_account | write | Opt-in |

## WORKSPACE

Documents, skills, memory, and workspace configuration the agent reads.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| workspace:read | Read workspace documents, skills, brand context, and agent memoryCovers: list_skills, load_skill, get_plugin_info, get_campaign_plan | read | Yes |
| workspace:write | Create and delete workspace documents and reportsCovers: create_document, delete_document, publish_plan_document | write | Yes |
| workspace:external_docs | Read and write Google Docs, Sheets, and Drive files in the connected Google accountCovers: create_google_doc, create_google_sheet, read_google_sheet, update_google_sheet | write | Opt-in |
| workspace:notify | Send messages to connected Slack channelsCovers: send_slack_message | write | Opt-in |
| workspace:code | Push generated code and assets to a connected GitHub repositoryCovers: publish_to_github | write | Opt-in |

## GROWTH & OUTBOUND

Prospecting, enrichment, and outbound sequences. Can contact real people.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| growth:read | Run company/contact discovery and firmographic enrichmentCovers: growth_discover, growth_enrich, builtwith_get_domain_technologies | read | Opt-in |
| growth:write | Run outbound pipelines that can contact real people — enable deliberatelyCovers: growth_run_pipeline | write | Opt-in |

## BILLING

Credit balance and spend visibility.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| billing:read | View credit balance and workspace spendCovers: get_credit_balance, get_billing_status, forecast_tool_cost, forecast_campaign_fee | read | Yes |

## COMMERCE

Shopify, Merchant Center, product feeds, catalogs, and discounts.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| commerce:read | Read products, orders, catalogs, and Merchant Center feed statusCovers: shopify_get_products, google_merchant_get_feed_status | read | Yes |
| commerce:write | Create and update products, discounts, catalogs, and product feeds — changes a live storefrontCovers: shopify_create_discount, meta_ads_create_product_catalog, google_merchant_submit_feed | write | Opt-in |

## EMAIL

Klaviyo and Loops email/SMS campaigns, flows, and templates.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| email:read | Read email/SMS campaigns, flows, templates, and engagementCovers: klaviyo_get_templates, get_email_engagers | read | Yes |
| email:write | Create and send email/SMS campaigns and flows — can send to real subscribersCovers: klaviyo_create_campaign, loops_send_event | write | Opt-in |

## ORGANIC SOCIAL

Publish organic posts, replies, and DMs from connected profiles. Posts publicly under the customer's identity.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| social:read | Read organic posts, engagement, and follower dataCovers: x_get_mentions, linkedin_list_posts | read | Yes |
| social:write | Publish organic posts, replies, and DMs under the customer's own identity — publicly visibleCovers: publish_organic_post, linkedin_post_content, x_quote_retweet | write | Opt-in |

## COMPETITIVE INTELLIGENCE

Competitor, market, keyword, and AI-search-visibility research.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| intel:read | Run competitor, keyword, market, and AI-search-visibility researchCovers: scrape_meta_ads_library, benchmark_ppc_budgets_spyfu, ask_gauge | read | Yes |
| intel:write | Create and update tracked competitors, prompts, and research projectsCovers: gauge_create_prompts, add_competitor | write | Opt-in |

## EVENTS

Luma events, webinars, and guest lists.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| events:read | Read events, webinars, and guest listsCovers: luma_get_events, luma_get_guests | read | Yes |
| events:write | Create events and add guests — can email real attendees on the platform's behalfCovers: luma_create_event, luma_update_event, luma_create_image, luma_create_guests | write | Opt-in |

## CODE & ENGINEERING

Generate and ship code, open pull requests, and run build pipelines. The most privileged group.

| Scope | What it permits | Type | In defaults |
| --- | --- | --- | --- |
| engineer:write | Generate and push code, open pull requests, and run build/validation pipelinesCovers: engineer_build_feature, create_engineer_run, engineer_rerun | write | Opt-in |

## Legacy scopes

Every key issued before the granular model carries both of these. They continue to work; the scopes above supersede them.

| Scope | What it permits |
| --- | --- |
| tools:read | Legacy: read access to every read-only tool and endpoint. Superseded by the granular read scopes below. |
| tools:write | Legacy: write access to every mutating tool and endpoint. Superseded by the granular write scopes below. |

## Denied requests

A request the key is not scoped for returns `403` with the missing scope named, so you can add exactly what is needed:

```
{
  "error": "Insufficient permissions",
  "message": "Insufficient permissions: 'update_campaign_budget' requires the 'budget:write' scope.",
  "required_scope": "budget:write"
}
```

[Previous Tool Reference](https://docs.syntermedia.ai/mcp/tools)

Was this page helpful?

YesNo

---

Source: https://docs.syntermedia.ai/mcp/scopes
Full docs as one file: https://docs.syntermedia.ai/llms-full.txt