Permissions (scopes) - CaptureFlow API

Each API key and each connected app has a set of scopes. A call that needs a scope the credential lacks is refused with insufficient_scope; the API reference lists the scope each operation needs.

Scopes

Scope	Allows
`ideas:read`	Read content ideas.
`ideas:write`	Create content ideas.
`inputs:read`	Read inputs (text, links, uploads) and their processing state.
`inputs:write`	Create inputs: text, links and file uploads.
`posts:read`	Read posts and check them against platform rules.
`posts:write`	Create and edit draft posts.
`posts:schedule`	Propose posts for scheduling or posting; the user accepts each proposal in CaptureFlow.
`strategy:read`	Read the content strategy.
`accounts:read`	Read connected social accounts.
`agent:run`	Start the content agent and read its runs.

brand:read, knowledge:read and analytics:read are reserved: no operation uses them yet.

Presets

Settings and the consent screen offer three presets:

Preset	Scopes
Read only	Every `:read` scope: ideas, inputs, posts, strategy and connected accounts.
Read and create drafts	Read only, plus `ideas:write`, `inputs:write`, `posts:write`.
Full access	Everything, including `posts:schedule` (proposals for your approval) and `agent:run`.

Even with Full access, nothing is published without the user: see Approvals.

Asking for more (step-up)

When a call needs a scope the credential lacks, the error names it:

HTTP/1.1 403 Forbidden
WWW-Authenticate: Bearer error="insufficient_scope", scope="posts:schedule", resource_metadata="https://api.captureflow.ai/.well-known/oauth-protected-resource"

{ "error": { "type": "permission_error", "code": "insufficient_scope", "details": { "required_scopes": ["posts:schedule"] }, "...": "..." } }

Connected apps can send the user through the authorization flow again, asking for the missing scope. MCP clients that support it do this on their own.
API keys can’t gain scopes: create a key with the permissions you need.