Scopes

Scopes control which tools an API key can access. Each scope follows the pattern {domain}:{action} where action is read or write.

Available scopes

Scope	Description
workspace:read	View workspace details and members
workspace:write	Update workspace settings, manage members and invitations
campaigns:read	List and view campaigns
campaigns:write	Create and update campaigns
leads:read	Search and view leads
leads:write	Import leads, queue enrichment
lead_lists:read	List and view lead lists
lead_lists:write	Create lead lists, add leads
workflows:read	List and view workflows
workflows:write	Trigger, update, and manage workflows
icps:read	List and view ICP scores
icps:write	Create, update, delete ICPs and trigger ICP scoring
content:read	List and view content posts, brand voice
content:write	Create, update, schedule, publish content
competitors:read	List and view competitor watches
competitors:write	Create, delete, pause, resume competitor watches
accounts:read	View LinkedIn account health, status, budgets, and ramp-up state
accounts:write	Trigger LinkedIn account operations (e.g. connections export)
automations:read	List scheduled automations and inspect job history
automations:write	Enable and disable scheduled automations
signals:read	List signal agents (audiences), their stats and leads
signals:write	Create, update, pause, resume, delete signal agents
inbox:read	List LinkedIn conversations, messages, and unread counts
inbox:write	Mark conversations read and refresh the inbox
integrations:read	List connected integrations and Apollo import progress
integrations:write	Connect/disconnect Apollo & Instantly, import Apollo lists
notifications:read	List notifications and unread counts
notifications:write	Mark notifications read
outreach:write	Direct LinkedIn outreach actions: connection request, like, comment, follow, InMail
google_integrations:read	View Google account integrations, calendar availability, warmup status
google_integrations:write	Send Gmail, manage calendar events, control email warmup
admin:read	Platform-admin read tools (blog, etc.) — mintable only by platform admins
admin:write	Platform-admin write tools (blog management, etc.) — mintable only by platform admins

Wildcard scope

The * scope grants access to all tools. It’s reserved for internal server-to-server connections — API keys always carry an explicit scope list.

Scope enforcement

Every tool checks scopes before executing. If a key lacks the required scope, the tool returns an error:

{
  "content": [{
    "type": "text",
    "text": "Insufficient permissions: \"campaigns:write\" scope is required to call campaignstack_create_campaign. Use campaignstack_whoami to check your current scopes."
  }],
  "isError": true
}

Note

write scopes only grant write access — they don’t implicitly include read. If you need both, grant both scopes to your API key.

Scope-to-tool mapping

Note

The tables below show representative tools per domain — they are not exhaustive. Each tool’s authoritative required scope is listed on its tool reference page (one page per domain), generated directly from the server. A few tools require a scope from a different domain than their name suggests — e.g. the AI craft tools (campaignstack_craft_*) require workflows:write, LinkedIn account tools require accounts:read/accounts:write, and automation tools require automations:read/automations:write. Always check the tool reference page when in doubt.

campaigns

Tool	Scope
campaignstack_list_campaigns	campaigns:read
campaignstack_get_campaign	campaigns:read
campaignstack_create_campaign	campaigns:write
campaignstack_update_campaign	campaigns:write

leads

Tool	Scope
campaignstack_search_leads	leads:read
campaignstack_get_lead	leads:read
campaignstack_import_leads_csv	leads:write
campaignstack_queue_leads	leads:write
campaignstack_build_search_url	leads:read

lead_lists

Tool	Scope
campaignstack_list_lead_lists	lead_lists:read
campaignstack_get_lead_list	lead_lists:read
campaignstack_create_lead_list	lead_lists:write
campaignstack_add_leads_to_list	lead_lists:write

workflows

Tool	Scope
campaignstack_list_workflows	workflows:read
campaignstack_get_workflow	workflows:read
campaignstack_update_workflow_status	workflows:write
campaignstack_trigger_workflow	workflows:write

icps

Tool	Scope
campaignstack_list_icps	icps:read
campaignstack_get_icp_scores	icps:read
campaignstack_trigger_icp_scoring	icps:write

content

Tool	Scope
campaignstack_list_content_posts	content:read
campaignstack_get_content_post	content:read
campaignstack_get_workspace_voice	content:read
campaignstack_create_content_post	content:write
campaignstack_update_content_post	content:write
campaignstack_delete_content_post	content:write
campaignstack_duplicate_content_post	content:write
campaignstack_schedule_content_post	content:write
campaignstack_submit_content_for_approval	content:write
campaignstack_approve_content_post	content:write
campaignstack_reject_content_post	content:write
campaignstack_unschedule_content_post	content:write
campaignstack_retry_content_post	content:write
campaignstack_update_brand_identity	content:write

No-scope tools

campaignstack_whoami requires no specific scope — any valid API key can call it.