Scopes
Scopes control what data an app can access. Limit your API client to the scopes it needs, and users can trust your app with their data.
You set the default scopes when you create your API client. With OAuth, you can restrict them further for each token.
Using Scopes
Section titled “Using Scopes”Nearly every route in the API requires a scope. If your client (or Access Token, with OAuth) doesn’t have the required scope, you’ll get a 403 Forbidden error.
There are 4 scopes, each with read and write access. Write access includes read access, so you don’t need to request both.
All Clients
Section titled “All Clients”Read only Can get the API landing page (/), /help, and /data/* routes. All clients can do this, regardless of scope.
Account
Section titled “Account”Read Can read from /account/*, /events/*, /ext_accounts/*, and /users/{email}/
Write Can write to /events/*, /ext_accounts/*
Public
Section titled “Public”Read Can read from /ranks, /reviews, /reports/ratings, /featured, and /products operations without knowing account products.
Write Can write to /reviews/*/response
Private
Section titled “Private”Read Can read from /reports/ads, /reports/adspend, /reports/sales, /archive, and /payments
Write No Additional Access
Products
Section titled “Products”Read Can GET a list of all products in the account using /products/mine or /ext_accounts/{id}/products. Products also become available in the /users/* routes.
Write Can PUT to /products/{product_id} to change the active and hidden fields
When you create an API Client (and get a Client Key and Secret), you’ll pick a default scope. Every request using HTTP Authentication uses that scope.
With OAuth, you can narrow the scope beyond what you set on the client. You can’t expand it. Pass a comma-separated list of scopes in the X-OAuth-Scope header. Write each scope as its name, a colon, and read or write.
For example, to write to products and read private and account data, set the header like this:
X-OAuth-Scope: products:write, private:read, account:read