Permissions

Every API key carries permissions, and every request it makes is checked against them. A key holds only what it was given: the key in a publishing script cannot read your invoices, and no key at all can create another key, sign anybody in, or reach another workspace.

Permissions come in two words per area. Write includes read, so a key that may change a thing can always see it.

The areas are grouped and ordered exactly as the dashboard's side menu is, so the picker on the screen and this page read the same way.

Overview

Area	Read	Write	What it covers
Posts	posts:read	posts:write	Every posting job from arrival to published, including cancelling and deleting one.
Posts - Approvals	approvals:read	approvals:write	Clearing or refusing a post that is waiting on a person.
Schedule	schedule:read	--	The posting calendar: what is due to go out, and when.
Compliance	compliance:read	--	The sealed record of everything handed over, approved and reported, checking a video against it, its export for an auditor, and the workspace's audit log.

Library

Area	Read	Write	What it covers
Clip studio	templates:read	templates:write	The templates a clip can be drawn with, their variants and the formats they come in.
Clip studio - Create clip	renders:read	renders:write	Rendering a clip on its own and downloading it, without a post going anywhere.
Media	media:read	media:write	Images, video, sound and fonts, and the clips a render produced.

Publication

Area	Read	Write	What it covers
Brands	brands:read	brands:write	Brand documents: names, colours, logos, disclaimers and the text that goes out with a post.
Channels	channels:read	channels:write	The accounts posts go to, what each one listens to, how its posts are handed over, and testing its platform connector, whose credentials a person with Administration sets in the dashboard.
Syndication	syndication:read	syndication:write	Your syndication groups and their iframes, the participants who signed up, the branding and email settings of what they see, and what each was sent.

Content sources

Area	Read	Write	What it covers
Ready-made feeds	feeds:read	feeds:write	The feeds Reelwire carries and which of them this workspace uses.
Post composer	postlists:read	postlists:write	Scheduled manual posts: the lists and the posts waiting in them.
Reelwire Pocket	pocket:read	pocket:write	Its settings, channels and actions, and the clips made with it. Connecting a phone stays with a person.
Custom feeds	streams:read	streams:write	Your own data streams: making them, naming what they carry, and mapping their fields.
Custom feeds - Send raw data	--	ingest:write	Push events into your custom feeds. This is what a producer or a trading system uses.

Connections

Area	Read	Write	What it covers
Webhook	webhooks:read	webhooks:write	Where posts are handed over by webhook, and a test delivery to it.
Activity	received:read	--	What came in: what arrived, what it was matched to, and what it produced or why it produced nothing.
Activity - What went out	connections:read	connections:write	What every hand-over sent, by email, by webhook and through the platform connector, and what came back.

My account

Area	Read	Write	What it covers
Team	team:read	team:write	The colleagues in this workspace, what each may do, and inviting or removing one.

Subscription

Area	Read	Write	What it covers
Allowance	allowance:read	--	How many renders this month holds and how many are left.
Plan	plan:read	--	Which tier this workspace is on and what that tier switches on.

Posts - Approvals is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

Compliance is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

Syndication is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

Team is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

Ready-made sets

The screen offers these as a starting point. They are ordinary permission lists: pick one, then narrow it.

Send raw data

For a producer or a trading system that only pushes events in.

ingest:write

Make and hand over posts

Everything needed to create content, hand it over and report it published: posts, post lists, media, renders.

posts:write
postlists:write
media:write
renders:write
templates:read
brands:read
channels:read

Read only

Reporting and dashboards: sees everything the workspace has, changes nothing.

posts:read
approvals:read
schedule:read
compliance:read
templates:read
renders:read
media:read
brands:read
channels:read
syndication:read
feeds:read
postlists:read
pocket:read
streams:read
webhooks:read
received:read
connections:read
team:read
allowance:read
plan:read

Run the whole workspace

Full configuration by machine. It still cannot create keys or sign anybody in.

posts:read
posts:write
approvals:read
approvals:write
schedule:read
compliance:read
templates:read
templates:write
renders:read
renders:write
media:read
media:write
brands:read
brands:write
channels:read
channels:write
syndication:read
syndication:write
feeds:read
feeds:write
postlists:read
postlists:write
pocket:read
pocket:write
streams:read
streams:write
ingest:write
webhooks:read
webhooks:write
received:read
connections:read
connections:write
team:read
team:write
allowance:read
plan:read

When a key is refused

A request a key may not make is answered with 403 and a body that names the permission and the fix, rather than a scope string you would have to look up:

{
  "type": "https://reelwire.io/problems/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "This key may not write here. Give it the \"Media: write\" permission, or use a key that has it."
}