Authorization and Permissions
Permission checks are enforced per endpoint after API key authentication.
Available Permissions
| Permission | Covers |
|---|---|
membership_types:read | List and view membership types and pricing |
events:read | List and view organisation events |
event_registrations:read | List and view event registrations and attendees |
event_orders:read | List and view event orders and payment state |
donations:read | List and view donations and donor details |
donation_subscriptions:read | List and view recurring donation subscriptions |
donation_campaigns:read | List and view fundraising campaigns |
webhooks:read | View subscriptions, catalogue and delivery history |
webhooks:write | Create, update and delete subscriptions, send tests and replay deliveries |
memberships:read | List and view memberships and billing state |
scans:read | List and view scan events |
members:read | List and view members |
members:write | Create and update members |
passes:read | List and view issued pass instances |
passes:issue | Issue passes and event tickets |
passes:revoke | Revoke issued passes |
passes:reinstate | Reinstate revoked passes |
passes:update_expiry | Update or remove pass expiry dates |
passes:send_email | Send pass delivery emails |
pass_templates:read | List and view pass templates |
Endpoint Mapping
| Endpoint group | Required permission |
|---|---|
GET /membership-types, GET /membership-types/{id} | membership_types:read |
GET /events, GET /event-records/{id} | events:read |
GET /event-registrations, GET /event-registrations/{id} | event_registrations:read |
GET /event-orders, GET /event-orders/{id} | event_orders:read |
GET /donations, GET /donations/{id} | donations:read |
GET /donation-subscriptions, GET /donation-subscriptions/{id} | donation_subscriptions:read |
GET /donation-campaigns, GET /donation-campaigns/{id} | donation_campaigns:read |
| Webhook subscription, catalogue and delivery history GET endpoints | webhooks:read |
| Webhook subscription POST, PUT and DELETE endpoints, tests and replay | webhooks:write |
GET /memberships, GET /memberships/{id} | memberships:read |
GET /scans, GET /scans/{id} | scans:read |
GET /members, GET /members/{id} | members:read |
POST /members, PUT /members/{id} | members:write |
GET /passes, GET /passes/{id} | passes:read |
POST /passes/issue | passes:issue |
POST /passes/{id}/revoke | passes:revoke |
POST /passes/{id}/reinstate | passes:reinstate |
PUT /passes/{id}/expiry | passes:update_expiry |
POST /passes/{id}/send-email | passes:send_email |
GET /pass-templates, GET /pass-templates/{id} | pass_templates:read |
If a key does not include the required permission, the API returns HTTP 403.
Existing API keys keep their current permissions. Enable the new scopes through API-key creation or editing under Integrations. Read and write webhook scopes are independent; grant both when an integration must provision endpoints and inspect results. Public webhook endpoints require organisation webhook access as well as public API access. All records are scoped to the key’s organisation.