Scopes and Permissions - Simply Tokenized API

The Simply Tokenized API uses a two-level permission model.

Level 1 — Credential categories

When an API credential is created in the Asset Manager dashboard, it is assigned one or more categories:

Category	Description
`OFFERINGS`	Read offering data
`ACCOUNT`	Create, read, and update accounts
`ORDER`	Create, read, update, and cancel orders
`WALLET`	Read wallets

Categories define the maximum permissions available to that credential.

Level 2 — Fine-grained scopes

At authentication time, request specific scopes in the scopes array. Only scopes allowed by the credential’s categories are granted.

Category	Available scopes
`OFFERINGS`	`offering.read`
`ACCOUNT`	`account.create`, `account.read`, `account.update`
`WALLET`	`wallet.read`
`ORDER`	`order.create`, `order.read`, `order.update`, `order.delete`

Endpoint → scope mapping

Endpoint	Required scope
`GET /api/offerings`	`offering.read`
`GET /api/offerings/{offeringId}`	`offering.read`
`POST /api/offerings/{offeringId}/orders`	`order.create`
`GET /api/offerings/{offeringId}/orders`	`order.read`
`GET /api/offerings/{offeringId}/orders/{orderId}`	`order.read`
`PATCH /api/offerings/{offeringId}/orders/{orderId}/cancel`	`order.update`
`POST /api/accounts`	`account.create`
`GET /api/accounts/{accountId}`	`account.read`
`PATCH /api/accounts/{accountId}`	`account.update`
`GET /api/accounts/{accountId}/orders`	`order.read`
`GET /api/accounts/{accountId}/transactions`	`account.read`
`GET /api/accounts/{accountId}/benefiting-persons`	`account.read`
`POST /api/accounts/{accountId}/benefiting-persons`	`account.create`
`GET /api/accounts/{accountId}/wallets`	`wallet.read`
`GET /api/accounts/{accountId}/wallets/{walletId}`	`wallet.read`
`GET /api/accounts/{accountId}/wallets/balances`	`wallet.read`

Insufficient scope error

If the token lacks a required scope:

{
  "error": {
    "type": "invalid_request_error",
    "code": "insufficient_scope",
    "message": "One or more requested scopes are not allowed for this API credential."
  }
}

HTTP status: 403 Forbidden

Best practices

Request the minimum scopes needed for your integration
Use separate credentials for read-only vs write operations when possible
Re-authenticate with expanded scopes if your integration requirements change

​Level 1 — Credential categories

​Level 2 — Fine-grained scopes

​Endpoint → scope mapping

​Insufficient scope error

​Best practices

Level 1 — Credential categories

Level 2 — Fine-grained scopes

Endpoint → scope mapping

Insufficient scope error

Best practices