Get started

Scopes

A scope is permission for one resource. Give each key the least it needs: a key that only syncs sales should not be able to read the guest book.

All scopes

Scope	Grants	Endpoints
`menu.read`	The menu an outlet sells	GET`/api-v1-menu`
`orders.create`	Creating an order that staff accept at the till	POST`/api-v1-orders-create`
`orders.read`	Reading back an order the API created	GET`/api-v1-orders-get/{id}`
`transactions.read`	Till transaction history and detail	GET`/api-v1-transactions` GET`/api-v1-transactions/{id}`
`customers.read`	The guest book	GET`/api-v1-customers` GET`/api-v1-customers/{id}`
`reservations.read`	Reservations, booking requests and slot availability	GET`/api-v1-reservations` GET`/api-v1-bookings` GET`/api-v1-bookings/{id}` GET`/api-v1-availability`
`reservations.write`	Confirming or rejecting booking requests	POST`/api-v1-bookings/{id}/confirm` POST`/api-v1-bookings/{id}/reject`
`reports.read`	The daily sales summary	GET`/api-v1-reports-daily`
`business.read`	The outlets the key may read	GET`/api-v1-locations`

Calling an endpoint without its scope answers 403 insufficient_scope, and the message names the missing scope. Scopes are set when the key is created; to change them, create a new key and revoke the old one.

Recipes

Integration	Scopes
Accounting sync	`transactions.read` + `reports.read`
CRM sync	`customers.read`
Booking widget back office	`reservations.read`
WhatsApp bot that confirms tables	`reservations.read` + `reservations.write`
Online shop sending orders to the till	`menu.read` + `orders.create` + `orders.read`
Multi-outlet dashboard	`business.read` + `reports.read`

Webhooks are not a scope: they are set up separately and cover every order, booking and reservation event you tick. See Webhooks. AI assistants use their own tokens, not API keys; see MCP.

Stuck? Quote the request_id from the response and write toSansflow support.Checked against API v1 on 8 Nov 2026.