Permissions and limits
Choose explicit read, preparation or management permissions. New management access needs fresh consent.
A connection carries explicit permissions and keeps your existing account role and workspace access. Empty permission lists grant nothing.
| OAuth consent | What it grants |
|---|---|
adapt:read |
Registered read permissions. |
adapt |
Reads and existing permissions for preparing changes. |
adapt:manage |
Read, preparation and separate customer management permissions. Ordinary changes can run directly; protected changes still require review. |
Existing access and refresh tokens are not silently widened. Reconnect with fresh consent for management. Creating a key also requires choosing its permissions while signed in.
| Management permission | Area |
|---|---|
account:manage |
Profile, preferences and workspace settings. Sensitive actions retain human verification. |
agents:manage |
Switches, limits, drafts, tasks and eligible job recovery. |
posts:manage |
Authored posts, media and sequences. Publishing and scheduling are protected. |
outreach:manage |
Campaigns and mailbox settings. Sending, warm-up and paid generation are protected. |
crm:manage |
Records, tasks, setup, imports and workflows. Protected recovery and external actions require review. |
team:manage |
Team changes within your role. Sensitive actions require review. |
connections:manage |
Your integrations and sharing. Provider consent stays with you. |
lists:manage |
Saved lists and searches. |
reports:manage |
Report schedules. Sending requires review. |
backups:manage |
On-demand export to the organisation’s Google Drive, including private data and readable held values. Fresh explicit consent and exact human review are required; owner or admin only. |
These differ from older scopes such as crm:write and outreach:write. The key selector and GET /market/tokens/scopes show available permissions. Defaults remain book:search, book:read and account:read.
Keys default to 365 days, at most 730. OAuth access tokens last one hour. Refresh tokens last 30 days and rotate on use. Authorisation codes last five minutes and work once.