Scopes and permissions: Automo developers
Every permission an assistant can ask for on Automo, which ones a workspace starts with, and which tools each one unlocks.
Diese Referenz ist auf Englisch veröffentlicht.
A token can only do what three things allow at once: the scopes the person ticked when they connected, what their own role in the workspace allows, and what the workspace admin has switched on for assistants in Settings, Claude Connector. Any of the three can narrow it; nothing widens it.
How a permission is granted
- Ask for scopes in the
scopeparameter of the authorize request (space separated). Ask only for what you use. - The person sees each permission as a checkbox and can untick any of them.
- The workspace's admin policy narrows the result. Most powerful permissions start off and stay off until an admin turns them on, for every connection at once.
- If a tool needs a permission the token lacks, the call is refused with 403 and, where a reconnect could add it, a
WWW-Authenticate: Bearer error="insufficient_scope"challenge naming the scope.
Every scope
| Scope | Allows | New workspaces | Tools |
|---|---|---|---|
files:read | Read files (media library) | see your workspace settings | none yet |
files:write | Upload files (media library) | see your workspace settings | none yet |
files:admin | Open restricted folders & change folder access | see your workspace settings | none yet |
kb:read | Read knowledge base | see your workspace settings | none yet |
kb:write | Write knowledge base pages | see your workspace settings | none yet |
chat:read | Read chat channels | see your workspace settings | none yet |
chat:write | Post chat messages | see your workspace settings | none yet |
brand:read | Read brand kits & brand assets | see your workspace settings | none yet |
brand:write | Create & edit brand kits (colours, fonts, logos, guidelines) | see your workspace settings | none yet |
templates:read | Read templates | see your workspace settings | none yet |
projects:read | Read projects, designs, videos & spreadsheets | see your workspace settings | none yet |
projects:write | Create and edit projects, designs, videos & spreadsheets | see your workspace settings | none yet |
campaigns:read | Read Automo Connect campaigns | see your workspace settings | none yet |
campaigns:write | Build and edit Automo Connect campaigns | see your workspace settings | none yet |
mail:read | Read your mail | see your workspace settings | none yet |
mail:send | Send mail as you | see your workspace settings | none yet |
meetings:read | Read meeting transcripts | see your workspace settings | none yet |
contacts:read | Read contacts | see your workspace settings | none yet |
crm:read | Read companies & deals | see your workspace settings | none yet |
crm:write | Create and update contacts, companies & deals | see your workspace settings | none yet |
support:read | Read support tickets | see your workspace settings | none yet |
support:write | Update support tickets | see your workspace settings | none yet |
tasks:read | Read tasks | see your workspace settings | none yet |
tasks:write | Create and update tasks | see your workspace settings | none yet |
calendar:read | Read your calendar | see your workspace settings | none yet |
calendar:write | Add events to your calendar, invite people, edit & remove your own | see your workspace settings | none yet |
calendar:team | See teammates' free/busy time (busy windows only) | see your workspace settings | none yet |
esign:read | Read envelopes sent for signature | see your workspace settings | none yet |
esign:write | Prepare documents for signature | see your workspace settings | none yet |
esign:send | Send or void documents for signature | see your workspace settings | none yet |
marketing:read | Read marketing email sequences | see your workspace settings | none yet |
marketing:write | Draft marketing email sequences (never activate them) | see your workspace settings | none yet |
sharing:read | See a project's public share links | see your workspace settings | none yet |
sharing:write | Create & revoke public share links | see your workspace settings | none yet |
retail:read | Read venues & menus | see your workspace settings | none yet |
retail:write | Set up venues & edit menus | see your workspace settings | none yet |
screens:read | Read venue screens | see your workspace settings | none yet |
screens:write | Put designs on venue screens | see your workspace settings | none yet |
ai_team:read | Read your AI team members | see your workspace settings | none yet |
ai_team:admin | Hire, change, pause & remove AI team members | see your workspace settings | none yet |
Protocol scopes
openid,email,profile: who connected (returned by /oauth/userinfo).offline_access: a refresh token, so the connection survives the access token expiring.
