OAuth & API scope reference
Every scope Pact exposes, what it grants, and recommended sets per use case.
Scopes control exactly what a token can do. Both OAuth tokens and API keys are scoped — request the minimum your integration needs. Workspace admins approve least-privilege apps faster, and a leaked low-scope token does less damage.
Scopes follow a resource:action shape: a read: scope lets you list and fetch; a write: scope lets you create and update.
All scopes
| Scope | Grants |
|---|---|
read:accounts | View company accounts |
write:accounts | Create and update company accounts |
read:contacts | View contacts |
write:contacts | Create and update contacts |
read:deals | View deals and pipeline |
write:deals | Create and update deals |
read:activities | View the activity feed |
write:activities | Log activities |
read:workflows | View workflow runs |
read:calls | View voice calls, transcripts, and the live call event stream |
voice:agent | Configure AI voice agents and place simulated test calls |
voice:campaign | Create and manage outbound call campaigns |
read:cases | View support cases and the unified inbox |
write:cases | Create, route, merge and reply to support cases |
read:kb | View knowledge-base articles |
write:kb | Create and update knowledge-base articles |
read:warehouse | View warehouse sync connections and run history |
write:warehouse | Configure warehouse connections and trigger syncs (admin) |
read:recordings | View call recordings and the deletion queue |
write:recordings | Manage recording retention policy and legal holds |
write:signals | Configure signal action rules (admin) |
write:context | Define and version-bump MCP context bundles |
The write:context, read:cases/write:cases, read:kb/write:kb, read:warehouse/write:warehouse, read:recordings/write:recordings, and write:signals scopes gate Pact's MCP tool server rather than a REST endpoint — see that page for the full tool-to-scope mapping.
Request multiple scopes as a space-separated list, for example read:contacts write:contacts read:deals.
Recommended sets per use case
| Use case | Scopes |
|---|---|
| Read-only dashboard / reporting | read:accounts read:contacts read:deals read:activities |
| Inbound lead capture (forms, web) | write:contacts write:accounts |
| Two-way CRM sync | read:accounts write:accounts read:contacts write:contacts read:deals write:deals |
| Activity logging (calls, emails) | read:contacts write:activities |
| Pipeline automation | read:deals write:deals read:workflows |
| Voice — call analytics / live feed | read:calls |
| Voice — AI agents + campaigns | read:calls voice:agent voice:campaign |
| Support — read cases + KB | read:cases read:kb |
| Support — triage and reply | read:cases write:cases read:kb write:kb |
| Data warehouse sync | read:warehouse write:warehouse |
Principles
- Least privilege. Start with
read:scopes; addwrite:only where you actually create or update records. - Read does not imply write.
read:contactscannot modify a contact — you needwrite:contactsfor that. - Scopes are checked per request. A call to a write endpoint with a read-only token returns
403 Forbidden, not401.
Changing scopes
To change an OAuth app's scopes, update it in Admin → API & developers — connected workspaces re-consent on the next authorization. For an API key, the scopes are fixed at creation; issue a new key (or rotate) to change them.