> ## Documentation Index
> Fetch the complete documentation index at: https://docs.captureflow.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions (scopes)

> What a key or connected app may do.

Each API key and each connected app has a set of scopes. A call that needs a scope the credential lacks is refused with [`insufficient_scope`](https://docs.captureflow.ai/api/errors#insufficient_scope); the API reference lists the scope each operation needs.

## Scopes

| Scope | Allows |
| - | - |
| `ideas:read` | Read content ideas. |
| `ideas:write` | Create content ideas. |
| `inputs:read` | Read inputs (text, links, uploads) and their processing state. |
| `inputs:write` | Create inputs: text, links and file uploads. |
| `posts:read` | Read posts and check them against platform rules. |
| `posts:write` | Create and edit draft posts. |
| `posts:schedule` | Propose posts for scheduling or posting; the user accepts each proposal in CaptureFlow. |
| `strategy:read` | Read the content strategy. |
| `accounts:read` | Read connected social accounts. |
| `agent:run` | Start the content agent and read its runs. |

`brand:read`, `knowledge:read` and `analytics:read` are reserved: no operation uses them yet.

## Presets

Settings and the consent screen offer three presets:

| Preset | Scopes |
| - | - |
| **Read only** | Every `:read` scope: ideas, inputs, posts, strategy and connected accounts. |
| **Read and create drafts** | Read only, plus `ideas:write`, `inputs:write`, `posts:write`. |
| **Full access** | Everything, including `posts:schedule` (proposals for your approval) and `agent:run`. |

Even with Full access, nothing is published without the user: see [Approvals](https://docs.captureflow.ai/guides/approvals.md).

## Asking for more (step-up)

When a call needs a scope the credential lacks, the error names it:

```http theme={null}
HTTP/1.1 403 Forbidden
WWW-Authenticate: Bearer error="insufficient_scope", scope="posts:schedule", resource_metadata="https://api.captureflow.ai/.well-known/oauth-protected-resource"
```

```json theme={null}
{ "error": { "type": "permission_error", "code": "insufficient_scope", "details": { "required_scopes": ["posts:schedule"] }, "...": "..." } }
```

* **Connected apps** can send the user through the authorization flow again, asking for the missing scope. MCP clients that support it do this on their own.
* **API keys** can't gain scopes: create a key with the permissions you need.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.