Scopes

Every Admin Key capability must be ticked explicitly; anything not ticked is refused.

Admin Keys are deny by default: only endpoints covered by a scope you explicitly ticked can be called. Everything else is refused.

The five scopes

Scope	What it allows	Ticked by default
account:read	View account profile and balance	Yes
logs:read	List and analyse call logs, and export them	Yes
usage:read	Export usage analytics by time, model and other dimensions	Yes
keys:read	View the API key list and single key details, without plaintext	No
keys:write	Create, update and delete API keys, still without plaintext	No

All three default scopes are read-only. Write access must be ticked by hand, and the interface warns you when you do.

Endpoints covered by each scope

account:read

Method	Path	Description
GET	/api/user/self	Account profile, including balance

logs:read

Method	Path	Description
GET	/api/log/self	Log details as a paginated JSON list
GET	/api/log/self/count	Number of log entries (request count)
GET	/api/log/self/stat	Call statistics (spend, RPM, TPM)
GET	/api/log/self/stream-export	Export log details as CSV

usage:read

Method	Path	Description
GET	/api/data/self/pivot/stream-export	Export usage analytics as CSV

keys:read

Method	Path	Description
GET	/api/token/	API key list
GET	/api/token/{id}	Single key details

keys:write

Method	Path	Description
POST	/api/token/	Create a key
PUT	/api/token/	Update a key
DELETE	/api/token/{id}	Delete a key

Full parameters and responses are in the API reference.

Refusal responses

There are two kinds of refusal, and the difference is whether ticking another scope fixes it.

Missing scope

The endpoint is available to Admin Keys, but this key does not have the required scope. Edit the key and tick it.

{
  "success": false,
  "code": "admin_key_scope_missing",
  "message": "The admin key is missing the required scope: keys:read"
}

The message names the scope that is missing.

Endpoint not available

This endpoint is not available to Admin Keys at all. No scope will help — sign in to the console instead.

{
  "success": false,
  "code": "admin_key_scope_forbidden",
  "message": "This endpoint is not available to admin keys, sign in to the console instead"
}

Admin, agent and supplier endpoints return the same code with wording that says so explicitly.

TIP

Using an Admin Key against /v1/chat/completions returns a dedicated message rather than a vague "invalid token". Seeing it means you reached for the wrong credential type.