Scopes

Scopes control which tools an API key can access. Each scope follows the pattern {domain}:{action} where action is read or write.

Available scopes

Scope	Description
`workspace:read`	View workspace details and members
`workspace:write`	Update workspace settings, manage members and invitations
`campaigns:read`	List and view campaigns
`campaigns:write`	Create and update campaigns
`leads:read`	Search and view leads
`leads:write`	Import leads, queue enrichment
`lead_lists:read`	List and view lead lists
`lead_lists:write`	Create lead lists, add leads
`workflows:read`	List and view workflows
`workflows:write`	Trigger, update, and manage workflows
`icps:read`	List and view ICP scores
`icps:write`	Trigger ICP scoring
`content:read`	List and view content posts, brand voice
`content:write`	Create, update, schedule, publish content
`competitors:read`	List and view competitor watches
`competitors:write`	Create, delete, pause, resume competitor watches

Wildcard scope

The * scope grants access to all tools. It’s automatically assigned in stdio mode (local development) and to server-to-server connections.

Scope enforcement

Every tool checks scopes before executing. If a key lacks the required scope, the tool returns an error:

{
  "content": [{
    "type": "text",
    "text": "Insufficient permissions: 'campaigns:write' scope is required to call campaignstack_create_campaign. Use campaignstack_whoami to check your current scopes."
  }],
  "isError": true
}

Scope-to-tool mapping

campaigns

Tool	Scope
`campaignstack_list_campaigns`	`campaigns:read`
`campaignstack_get_campaign`	`campaigns:read`
`campaignstack_create_campaign`	`campaigns:write`
`campaignstack_update_campaign`	`campaigns:write`

leads

Tool	Scope
`campaignstack_search_leads`	`leads:read`
`campaignstack_get_lead`	`leads:read`
`campaignstack_import_leads_csv`	`leads:write`
`campaignstack_queue_linkedin_leads`	`leads:write`
`campaignstack_build_search_url`	`leads:read`

lead_lists

Tool	Scope
`campaignstack_list_lead_lists`	`lead_lists:read`
`campaignstack_get_lead_list`	`lead_lists:read`
`campaignstack_create_lead_list`	`lead_lists:write`
`campaignstack_add_leads_to_list`	`lead_lists:write`

workflows

Tool	Scope
`campaignstack_list_workflows`	`workflows:read`
`campaignstack_get_workflow`	`workflows:read`
`campaignstack_update_workflow_status`	`workflows:write`
`campaignstack_trigger_workflow`	`workflows:write`

icps

Tool	Scope
`campaignstack_list_icps`	`icps:read`
`campaignstack_get_icp_scores`	`icps:read`
`campaignstack_trigger_icp_scoring`	`icps:write`

content

Tool	Scope
`campaignstack_list_content_posts`	`content:read`
`campaignstack_get_content_post`	`content:read`
`campaignstack_get_workspace_voice`	`content:read`
`campaignstack_create_content_post`	`content:write`
`campaignstack_update_content_post`	`content:write`
`campaignstack_delete_content_post`	`content:write`
`campaignstack_duplicate_content_post`	`content:write`
`campaignstack_schedule_content_post`	`content:write`
`campaignstack_submit_content_for_approval`	`content:write`
`campaignstack_approve_content_post`	`content:write`
`campaignstack_reject_content_post`	`content:write`
`campaignstack_unschedule_content_post`	`content:write`
`campaignstack_retry_content_post`	`content:write`
`campaignstack_update_brand_identity`	`content:write`

No-scope tools

campaignstack_whoami requires no specific scope — any valid API key can call it.