> For the complete documentation index, see [llms.txt](https://docs.tryterra.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tryterra.co/reference/admin-api/scopes.md).

# Scopes

Every scope a personal access token can hold.

A [personal access token](/reference/admin-api/personal-access-tokens.md) holds a set of scopes. Each operation needs one. A request without it fails with `403` and `code: scope_missing`.

| Scope                                     | Allows                                                             |
| ----------------------------------------- | ------------------------------------------------------------------ |
| `account:read`, `account:write`           | See and change your profile, company details, and environment IDs  |
| `providers:read`, `providers:write`       | See and change which wearables and apps are on, and their settings |
| `destinations:read`, `destinations:write` | See and change where your data is sent                             |
| `events:read`, `events:write`             | See the log of data sent to you, and send it again                 |
| `connections:read`                        | See which of your users have connected                             |
| `payloads:read`                           | See your users' health data                                        |
| `dataconfig:read`, `dataconfig:write`     | See and change which health data fields you get                    |
| `scores:read`, `scores:write`             | See and change which scores are on, and their settings             |
| `models:read`                             | See the available models and their past results                    |
| `testdata:write`                          | Send made-up health data, from one-off events or test users        |
| `keys:read`, `keys:write`                 | See your API key and other secrets, and replace the API key        |
| `tokens:read`, `tokens:write`             | See, create, and revoke data access tokens                         |
| `tokens:admin`                            | See and revoke every personal access token on your account         |
| `entitlements:read`                       | See which features your company has access to                      |
| `billing:read`, `billing:write`           | See and change your plan, invoices, and payment details            |
| `team:read`, `team:write`                 | See, invite, change, and remove team members                       |

## Off by default

`billing:write`, `keys:write`, `tokens:write`, `tokens:admin`, and `team:write` can spend money, issue credentials, or change who has access. They are only granted when picked on purpose, and only account admins can grant them.

## Account-wide scopes

`account:*`, `billing:*`, `team:*`, `entitlements:read`, and `tokens:admin` act on your whole account. A token limited to some environments cannot hold them.