Scopes

Scopes control which tools an API key can call. Each scope follows the pattern {domain}:{action}, where action is read or write. Every tool requires exactly one scope, or none.

Scope-to-tool matrix

The matrix below is generated from the MCP server’s tool catalog on every docs build, so it always matches what the server enforces. Each tool links to its reference entry.

Scope	Grants	Tools
`workspace:read`	Read workspaces and workspace-level settings	`estimate_cost`, `get_workspace_memories`, `get_workspaces`
`workspace:write`	Change workspaces and workspace-level settings; implies `onboarding:write`	`create_workspace`, `delete_workspace_memory`, `edit_workspace`, `edit_workspace_members`, `edit_workspace_memory`, `propose_workspace_playbook_change`, `refresh_workspace_playbook`, `submit_feedback`
`campaigns:read`	Read campaigns	`analyze_company_website`, `get_campaigns`
`campaigns:write`	Change campaigns	`edit_campaign`
`leads:read`	Read leads and lead-sourcing data	`get_companies`, `get_company_employee_watches`, `get_lead_comments`, `get_lead_enrichments`, `get_lead_refresh_status`, `get_leads`, `get_signal_watches`
`leads:write`	Change, import and enrich leads	`add_leads_to_external_destination`, `delete_company_employee_watch`, `delete_signal_watch`, `edit_companies`, `edit_company_employee_watch`, `edit_leads`, `edit_signal_watch`, `enrich_companies`, `enrich_leads`, `import_external_leads`, `import_leads`, `lookup_company`, `refresh_companies`, `refresh_leads`
`lead_lists:read`	Read lead lists	`get_lead_lists`
`lead_lists:write`	Change lead lists	`delete_lead_list`, `edit_lead_list`
`workflows:read`	Read workflows and their activity	`diagnose_workflow_sourcing`, `explain_draft`, `get_reviews`, `get_workflow_node_types`, `get_workflows`
`workflows:write`	Change and run workflows	`cancel_workflow_node_leads`, `craft_message`, `decide_review`, `delete_workflow`, `edit_draft`, `edit_workflow`, `edit_workflow_graph`, `recover_review`, `retry_workflow_entries`, `trigger_workflow`
`icps:read`	Legacy: ICPs are now read through `campaignstack_get_campaigns`	No current tool
`icps:write`	Legacy: ICPs are now edited through `campaignstack_edit_campaign`	No current tool
`content:read`	Read content and craft configuration	`get_content`, `get_craft_config_tree`, `preview_craft_prompt`
`content:write`	Change content	`delete_content`, `edit_content`, `edit_identity`, `refresh_identity_voice`
`competitors:read`	Read competitor watches	`get_competitor_watches`
`competitors:write`	Change competitor watches	`delete_competitor_watch`, `edit_competitor_watch`
`accounts:read`	Read LinkedIn accounts	`get_accounts`, `get_identities`
`accounts:write`	Change LinkedIn accounts	`connect_account`, `edit_account`, `edit_workspace_accounts`, `export_linkedin_connections`
`automations:read`	Legacy: no current tool requires it	No current tool
`automations:write`	Legacy: no current tool requires it	No current tool
`inbox:read`	Read the inbox	`get_conversations`
`inbox:write`	Act in the inbox, including sending messages	`edit_conversations`, `refresh_inbox`, `send_message`
`signals:read`	Read signal agents, watches and job alerts	`get_exclusions`, `get_job_applications`, `get_job_watchers`, `get_signal_agents`, `suggest_job_application_profile`
`signals:write`	Change signal agents, watches and job alerts	`answer_job_question`, `apply_to_job`, `archive_job_watcher`, `delete_signal_agent`, `edit_exclusions`, `edit_job_watcher`, `edit_signal_agent`
`integrations:read`	Read integrations	`get_integrations`
`integrations:write`	Change integrations and move leads through them	`configure_integration`, `edit_workspace_integrations`, `export_leads_to_crm`
`notifications:read`	Read notifications	`get_notifications`, `get_review_time`
`notifications:write`	Change notifications and preferences	`edit_notifications`, `edit_user`
`outreach:write`	Single LinkedIn actions: connection request, InMail, like, comment, follow	`comment_on_post`, `follow_profile`, `like_post`, `send_connection_request`, `send_inmail`
`google_integrations:read`	Read calendars and meetings	`get_calendar_availability`, `get_meetings`
`google_integrations:write`	Send email and change calendar events and meetings	`cancel_meeting`, `delete_calendar_event`, `edit_calendar_event`, `edit_meeting`, `prepare_meeting_brief`, `send_email`
`ads:read`	LinkedIn Ads (not yet public)	No current tool
`ads:write`	LinkedIn Ads (not yet public)	No current tool
`seo:read`	SEO and AI visibility (not yet public)	No current tool
`seo:write`	SEO and AI visibility (not yet public)	No current tool
`magnets:read`	Read lead magnets	`get_lead_magnets`
`magnets:write`	Discover and change lead magnets	`discover_lead_magnets`, `edit_lead_magnets`
`proxy:read`	Legacy: no current tool requires it	No current tool
`proxy:write`	Set a LinkedIn account’s private proxy (API key only)	`edit_account_proxy`
`company_intel:read`	Legacy: company facts are read through `campaignstack_get_companies`	No current tool
`company_intel:write`	Legacy: company refreshes run through `campaignstack_refresh_companies`	No current tool
`onboarding:write`	Fill a new workspace’s self-description (`campaignstack_onboard_workspace`)	`onboard_workspace`

Tools that need no scope (any valid key can call them): explain_capabilities, get_platform_capabilities, whoami.

Scopes marked Legacy can still be granted to a key, but no current tool requires them. Their tools were folded into broader ones during the V2 consolidation. The ads and seo scopes belong to tools that are not public yet.

Read and write are separate

write scopes only grant write access; they don’t include read. If an agent needs both (almost always), grant both.

The one implication: workspace:write also grants onboarding:write.

Wildcard scope

The * scope grants access to all tools. It’s reserved for internal server-to-server connections. API keys always carry an explicit scope list.

Scope enforcement

Every tool checks its scope before executing. If a key lacks it, the tool returns an error instead of running:

{
  "content": [{
    "type": "text",
    "text": "SCOPE_REQUIRED: \"campaigns:write\" scope is required to call campaignstack_edit_campaign. This API key cannot access it. Use campaignstack_whoami to check your current scopes."
  }],
  "isError": true
}

campaignstack_whoami needs no scope, so any valid key can call it to see which scopes it holds.