Scopes

The Gateway supports 19 scopes. A credential holds a subset of its application’s scopes. OAuth tokens can narrow them further with the scope parameter.

Scope	Allows
website_read	List granted websites. Also required for event subscriptions and realtime sockets.
health_read	Check a website’s enrollment readiness.
conversation_read	Conversation and visitor metadata, visitor history, dispositions, saved responses, saved links and offers. Required by most conversation reads.
message_content_read	Message text, transcripts, subjects and note content, together with the message_content flag.
contact_read	Contact IDs and blocked state.
contact_read_pii	Personal fields such as contact name, email and phone, and visitor nickname, together with the pii flag. Also required for transcripts.
internal_notes_read	Internal operator messages in transcripts when include_internal=true, together with the internal_notes flag.
visitor_notes_read	Visitor and contact notes.
visitor_notes_write	Add visitor notes.
conversation_update	Set a conversation’s disposition.
file_read	Attachment metadata and content.
directory_read	The website’s operator directory.
live_read	The website’s channels and teams.
reports_read	The AI conversation summary report.
config_read	AI feature configuration metadata.
config_plan	Preview an AI feature configuration change. Nothing is saved.
ai_features_read	List and read AI features.
ai_execute	Run an AI feature on supplied text.
event_read	Event pull subscriptions and realtime sockets.

Data access flags

Flag	Covers	Needed with
message_content	Message text, subjects and note content	message_content_read
pii	Personal information about contacts and visitors	contact_read_pii
internal_notes	Internal notes and internal operator messages	internal_notes_read or visitor_notes_read

The live list is also published, without authentication, at /.well-known/oauth-authorization-server under scopes_supported.