Scopes

The thirty-one scopes a credential can carry, and the pace each one implies.

A scope is written app:resource:verb. A credential carries an explicit list of them and nothing else.

No inheritance and no wildcards

The check is an exact string comparison. There is no hierarchy:

wrap:contacts:write does not imply wrap:contacts:read.
flow:catalog:write does not imply flow:catalog:read.
There is no wrap:* or anything like it.

If your integration reads and writes contacts, it needs both ticked. That is more verbose, and it is what makes "what can this key do" answerable by reading a list.

The class sets the pace

Every scope belongs to a class, and the class fixes how many requests a minute that credential gets for that scope:

Class	Per minute
Read	120
Write	30
Manage	30

The budgets are independent. An integration that reads a lot and writes a little does not spend its read allowance by writing.

The catalogue

Nest

Scope	What it allows	Class
`nest:workspace:read`	Read the workspace and its members	Read
`nest:notifications:read`	Read notifications	Read

Wrap

Scope	What it allows	Class
`wrap:contacts:read`	Read contacts and companies	Read
`wrap:conversations:read`	Read conversations	Read
`wrap:deals:read`	Read deals	Read
`wrap:reports:read`	Read reports	Read
`wrap:notes:write`	Create contact notes	Write
`wrap:follow-ups:write`	Create and read reminders	Write
`wrap:deals:write`	Update deals	Write
`wrap:conversations:write`	Manage conversations	Write
`wrap:contacts:write`	Create and update contacts and companies	Write
`wrap:links:write`	Link to Flow (SAME_AS)	Write

Swarm

Scope	What it allows	Class
`swarm:tasks:read`	Read tasks	Read
`swarm:tasks:write`	Create and update tasks	Write
`swarm:channels:read`	Read public channels and messages	Read
`swarm:dms:read`	Read your direct messages	Read
`swarm:people:read`	See who is in the workspace and who is online	Read
`swarm:activity:read`	See the workspace’s recent activity	Read
`swarm:messages:write`	Post messages to channels	Write
`swarm:calendar:read`	Read your calendar	Read
`swarm:calendar:write`	Create and manage events on your calendar	Write

Flow

Scope	What it allows	Class
`flow:catalog:read`	Read the catalogue	Read
`flow:stock:read`	Read stock	Read
`flow:partners:write`	Create and search partners	Write
`flow:sales:write`	Record sales	Write
`flow:bills:write`	Ingest supplier bills	Write
`flow:open-items:read`	Read receivables and payables	Read
`flow:webhooks:manage`	Manage webhooks	Manage
`flow:documents:read`	Read invoices and payables	Read
`flow:payments:write`	Record payments	Write
`flow:catalog:write`	Update the catalogue	Write
`flow:pos`	Operate the point of sale	Write

Granularity of the write scopes

Some write scopes are the only door to their resource, so reading it forces you to ask for write. wrap:notes:write is what lets you list notes, wrap:follow-ups:write is what lets you list reminders, and flow:partners:write is what lets you search partners.

Keep that in mind when ticking boxes: if all you wanted was to read one of those three, the credential will be able to write it too.