> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentsfleet.net/llms.txt
> Use this file to discover all available pages before exploring further.

# API scopes

> Permissions that an agentsfleet access token can carry.

# API scopes

## Synopsis

Each access token carries named scopes. An API request fails when the token lacks the required scope.

Some scope groups use `read`, `write`, and `admin` levels. A higher level includes every lower level in the same group.

## Example with output

This request uses an obviously fake token. Replace the token with a tenant API key from **Settings → API Keys**.

```bash theme={"theme":"vesper"}
curl -s https://api.agentsfleet.net/v1/fleets -H 'Authorization: Bearer af_test_00000000'
```

```text theme={"theme":"vesper"}
{"title":"Insufficient scope","error_code":"UZ-AUTH-022","detail":"Missing required scope: fleet:read"}
```

## Options

| Scope                    | Effect                                 | Included by                    |
| ------------------------ | -------------------------------------- | ------------------------------ |
| `fleet:read`             | Reads fleets, events, and memory.      | `fleet:write`, `fleet:admin`   |
| `fleet:write`            | Creates, updates, and messages fleets. | `fleet:admin`                  |
| `fleet:admin`            | Deletes fleets.                        | None                           |
| `secret:read`            | Lists secret names and metadata.       | `secret:write`                 |
| `secret:write`           | Creates, rotates, and deletes secrets. | None                           |
| `apikey:read`            | Lists tenant API keys.                 | `apikey:write`, `apikey:admin` |
| `apikey:write`           | Creates and rotates tenant API keys.   | `apikey:admin`                 |
| `apikey:admin`           | Revokes tenant API keys.               | None                           |
| `fleetkey:read`          | Lists fleet keys.                      | `fleetkey:write`               |
| `fleetkey:write`         | Creates and deletes fleet keys.        | None                           |
| `grant:read`             | Lists integration grants.              | `grant:write`                  |
| `grant:write`            | Revokes integration grants.            | None                           |
| `connector:read`         | Reads connector state.                 | `connector:write`              |
| `connector:write`        | Starts a connector setup flow.         | None                           |
| `billing:read`           | Reads the tenant balance and charges.  | None                           |
| `workspace:admin`        | Creates and lists workspaces.          | None                           |
| `library:write`          | Adds an entry to a workspace library.  | None                           |
| `platform-library:write` | Adds an entry to the platform library. | None                           |
| `approval:read`          | Reads pending approvals.               | None                           |
| `approval:resolve`       | Approves or denies a request.          | None                           |

Operator tokens may carry `runner:*`, `platform-key:*`, `platform-library:*`, `model:*`, or `workspace:any`. Tenant integrations do not need these scopes.

## Errors

### UZ-AUTH-022: Insufficient scope

The token lacks the scope named in `detail`. Create a new key with that scope, then retry the request.

Do not add unrelated scopes. A narrower key limits the effect of a leaked key.

## Related pages

* [API introduction](/api-reference/introduction)
* [Error codes](/api-reference/error-codes)
* [Client configuration](/cli/configuration)