Scopes and permission filtering

Understand the two authorization gates applied to every request.

A token scope is a coarse gate. The resolved user must also pass the same permission rules used by the staff application. Scopes can narrow access; they never widen that user’s access.

The current reference documents read scopes for matters, relations, documents, hours, tasks, billing, and BI, plus write scopes for matters, relations, hours, and tasks. A missing scope returns 403. Resource permissions are applied before serialization, so list totals include only visible rows.

Open the published OpenAPI JSON to see the required scope for each operation, or read the developer API map.