Permissions

Every API key carries permissions, and every request it makes is checked against them. A key holds only what it was given: the key in a publishing script cannot read your invoices, and no key at all can create another key, sign anybody in, or reach another workspace.

Permissions come in two words per area. Write includes read, so a key that may change a thing can always see it.

The areas are grouped and ordered exactly as the dashboard's side menu is, so the picker on the screen and this page read the same way.

Overview

Area	Read	Write	What it covers
Posts	posts:read	posts:write	Every posting job from arrival to published, including cancelling and deleting one.
Posts - Approvals	approvals:read	approvals:write	Clearing or refusing a post that is waiting on a person.
Schedule	schedule:read	--	The posting calendar: what is due to go out, and when.

Library

Area	Read	Write	What it covers
Templates	templates:read	templates:write	The templates a clip can be drawn with, their variants and the formats they come in.
Templates - Direct export	renders:read	renders:write	Rendering a clip on its own and downloading it, without a post going anywhere.
Media	media:read	media:write	Images, video, sound and fonts, and the clips a render produced.
Media - AI assistant	ai:read	ai:write	Making pictures, videos, fonts and texts with the AI services the workspace connected, and keeping them in the media library.

Publication

Area	Read	Write	What it covers
Brands	brands:read	brands:write	Brand documents: names, colours, logos, disclaimers and the text that goes out with a post.
Channels	channels:read	channels:write	The accounts posts go to, what each one listens to, and the credentials it publishes with.
Syndication	syndication:read	syndication:write	Your syndication groups and their iframes, the subscribers who signed up, the branding and email settings of what they see, and what each was sent.

Content sources

Area	Read	Write	What it covers
Feeds	feeds:read	feeds:write	The feeds Reelwire carries and which of them this workspace uses.
Manual post lists	postlists:read	postlists:write	Scheduled manual posts: the lists and the posts waiting in them.
Custom feeds	streams:read	streams:write	Your own data streams: making them, naming what they carry, and mapping their fields.
Custom feeds - Send raw data	--	ingest:write	Push events into your custom feeds. This is what a producer or a trading system uses.

Connections

Area	Read	Write	What it covers
Webhook - Delivery log	connections:read	connections:write	What every hand-over sent, by email and by webhook, and what came back.
Webhook	webhooks:read	webhooks:write	Where posts are handed over by webhook, and a test delivery to it.
Received	received:read	--	What arrived, what it was matched to, and what it produced or why it produced nothing.

Performance

Area	Read	Write	What it covers
Analytics	analytics:read	analytics:write	How your published posts did, compared by cut, brand, language, channel and platform, and every reading reported for each.
A/B tests	abtests:read	abtests:write	Starting, ending and deciding tests of two to four versions of a channel's posts.

My account

Area	Read	Write	What it covers
Team	team:read	team:write	The colleagues in this workspace, what each may do, and inviting or removing one.

Subscription

Area	Read	Write	What it covers
Allowance	allowance:read	--	How many renders this month holds and how many are left.
Plan	plan:read	--	Which tier this workspace is on and what that tier switches on.

Syndication is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

Analytics is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

A/B tests is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

Team is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.

Ready-made sets

The screen offers these as a starting point. They are ordinary permission lists: pick one, then narrow it.

Send raw data

For a producer or a trading system that only pushes events in.

ingest:write

Make and hand over posts

Everything needed to create content, hand it over and report it published: posts, post lists, media, renders.

posts:write
postlists:write
media:write
renders:write
templates:read
brands:read
channels:read

Read only

Reporting and dashboards: sees everything the workspace has, changes nothing.

posts:read
approvals:read
schedule:read
templates:read
renders:read
media:read
ai:read
brands:read
channels:read
syndication:read
feeds:read
postlists:read
streams:read
connections:read
webhooks:read
received:read
analytics:read
abtests:read
team:read
allowance:read
plan:read

Run the whole workspace

Full configuration by machine. It still cannot create keys or sign anybody in.

posts:read
posts:write
approvals:read
approvals:write
schedule:read
templates:read
templates:write
renders:read
renders:write
media:read
media:write
ai:read
ai:write
brands:read
brands:write
channels:read
channels:write
syndication:read
syndication:write
feeds:read
feeds:write
postlists:read
postlists:write
streams:read
streams:write
ingest:write
connections:read
connections:write
webhooks:read
webhooks:write
received:read
analytics:read
analytics:write
abtests:read
abtests:write
team:read
team:write
allowance:read
plan:read

When a key is refused

A request a key may not make is answered with 403 and a body that names the permission and the fix, rather than a scope string you would have to look up:

{
  "type": "https://reelwire.io/problems/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "This key may not write here. Give it the \"Media: write\" permission, or use a key that has it."
}