Public API
Scopes
API key resource and action permissions for the Public API
Scopes limit what a key can do. Prefer least privilege: grant only the resources and actions your integration needs.
Format
Scopes are stored as a map of resource → actions. Missing a required action returns 403 with detail like API key lacks scope orders:write.
Available scopes
| Resource | Actions |
|---|---|
events | read, write, delete |
ticket_types | read, write, delete |
orders | read, write, cancel |
tickets | read, write, issue, check_in, cancel |
discounts | read, write, delete, validate |
webhooks | read, write, delete |
Typical mappings
| Operation | Required scope |
|---|---|
| List / get events | events:read |
| Create / update event | events:write |
| Create order / checkout | orders:write |
| Cancel order | orders:cancel |
| Manually issue tickets | tickets:issue |
| Check in by code | tickets:check_in |
| Validate discount code | discounts:validate |
| Manage webhook endpoints | webhooks:write |
Example key permissions
{
"events": ["read", "write"],
"ticket_types": ["read"],
"orders": ["read", "write"],
"tickets": ["read", "issue", "check_in"],
"discounts": ["read", "validate"],
"webhooks": ["read", "write"]
}Rotate a key in the dashboard when scopes change or a secret may have leaked. Rotation revokes the old secret and issues a replacement.