---
title: "Scopes"
description: "Scopes"
---

# Scopes

API keys are least-privilege and **default-deny**. Scopes are read/write per area:

| Scope | Grants |
| --- | --- |
| `employees:read` | Read minimized employee records. |
| `employees:read:pii` | Additionally expose salaries / personnummer. |
| `surveys:read` / `surveys:write` | Read / manage survey campaigns. |
| `settings:read` / `settings:write` | Read / manage org settings. |
| `users:read` / `users:write` | Read / manage user accounts. |
| `roles:read` / `roles:write` | Read / manage custom roles. |
| `analytics:read` | Read computed pay-gap results. |

`employees:read` strips salary and personnummer; those are gated behind the
separate `employees:read:pii` scope.