API scopes

# Scopes

import {Head} from "zudoku/components";

<Head>
  <title>API scopes | Domain Chief</title>
</Head>

Scopes limit what an access token can do. Choose them when you create an [access token](/developers/authentication#access-tokens). The general [scopes guide](/developers/scopes) explains how Chief Tools applies scopes across its APIs.

Each endpoint in the [API playground](/api/domainchief) lists its required scope under security.

## Available scopes

### Full access

| Scope | Access |
|---|---|
| `domainchief` | Every Domain Chief API endpoint |

### Broad scopes

| Scope | Access |
|---|---|
| `domainchief:read` | Read all resources |
| `domainchief:write` | Read and update resources, except domain registration, transfer operations, and immediate deletion |

### Domains

| Scope | Access |
|---|---|
| `domainchief:domains` | All domain operations |
| `domainchief:domains:read` | List and view domains |
| `domainchief:domains:read:availability` | Check domain availability |
| `domainchief:domains:write` | Update domain settings |
| `domainchief:domains:register` | Register domains and manage inbound transfers |
| `domainchief:domains:transfer` | View or send authorization codes and manage outbound transfers |
| `domainchief:domains:delete` | Delete domains immediately |

<Callout type="info">
Registration, transfer, and immediate deletion use separate scopes because they change domain ownership or lifecycle state. Grant `domainchief:domains` only when an integration needs every domain operation.
</Callout>

### Contacts

| Scope | Access |
|---|---|
| `domainchief:contacts:read` | List and view contacts |
| `domainchief:contacts:write` | Create, update, and delete contacts |

### Events

| Scope | Access |
|---|---|
| `domainchief:events:read` | Read the team's event feed |

### DNS records

| Scope | Access |
|---|---|
| `domainchief:dns:read` | List and view DNS records |
| `domainchief:dns:write` | Create, update, delete, clear, and reset DNS records |

### Redirects

| Scope | Access |
|---|---|
| `domainchief:redirects_web:read` | List and view web redirects |
| `domainchief:redirects_web:write` | Create, update, and delete web redirects |
| `domainchief:redirects_mail:read` | List and view mail redirects |
| `domainchief:redirects_mail:write` | Create, update, and delete mail redirects |

### TLDs and activity

| Scope | Access |
|---|---|
| `domainchief:tlds:read` | List and view available TLDs and pricing |
| `domainchief:activity:read` | View domain activity logs |

## Common token setups

Start with the narrowest scopes that cover the integration.

### Manage DNS records

```text
domainchief:dns:write
```

The token can read and change DNS records. It cannot list domains, manage contacts, or run domain lifecycle operations.

### Read data for monitoring

```text
domainchief:read
```

The token can read domains, contacts, events, DNS records, TLDs, and activity. It cannot change them.

### Keep a local copy in sync

```text
domainchief:events:read, domainchief:domains:read, domainchief:contacts:read
```

The token can read the team event feed and retrieve current domain and contact state. It cannot change those resources. The [data synchronization guide](/developers/domainchief/guides/sync-data) explains the snapshot and cursor workflow.

### Check domain availability

```text
domainchief:domains:read:availability
```

The token can check availability. It cannot list domains or retrieve an existing domain.

### Manage existing domains

```text
domainchief:domains:write, domainchief:dns:write, domainchief:contacts:write
```

The token can update existing domains, DNS records, and contacts. It cannot register domains, manage transfers, or delete domains immediately.