Permission scopes

API-key scopes use resource:action. A key can receive only known scopes held by the member creating it. Project scope and permission scope are both enforced: neither can widen the other.

The authenticated scope catalog at GET /api/v1/account/api-keys/scopes and Settings → Access is authoritative. The groups below describe the current selectable catalog.

Telemetry and investigation

Resource	Scopes
Ingestion	ingest:write
Traces	traces:read, traces:delete
Logs	logs:read, logs:delete
Metrics	metrics:read, metrics:delete
Errors and Issues	errors:read, errors:write, errors:delete
Query and search	query:read, query:write, search:read
Saved searches	saved_search:read, saved_search:write, saved_search:delete
Customers and accounts	persons:read, groups:read, groups:write, groups:delete
Events and flags	analytics:read, analytics:write, flags:read, flags:write, flags:delete
Anomalies	anomalies:read, anomalies:write, anomalies:delete
Replay	replay:read, replay:write, replay:delete
Releases	releases:read, releases:write
Export	export:read, export:write

errors:write allows Issue lifecycle actions and symbol uploads; deleting error data requires errors:delete. Application SDKs use ingest:write for OTLP telemetry and captured errors, plus analytics:write when sending diagnostic, identify, group, or screen events through the capture surface. Session replay uses replay:write instead of ingest:write.

Response and collaboration

Resource	Scopes
Alerts	alerts:read, alerts:acknowledge, alerts:resolve, alerts:rules:read, alerts:rules:write, alerts:rules:delete
Silences	silences:read, silences:write, silences:delete
Delivery channels	channels:read, channels:write, channels:delete
On-call	oncall:read, oncall:write, oncall:delete
Escalation	escalation:read, escalation:write, escalation:delete
Incidents	incidents:read, incidents:respond, incidents:write, incidents:delete
Dashboards	dashboard:read, dashboard:write, dashboard:delete
Connections and tickets	connections:read, connections:write, connections:delete, tickets:read, tickets:write, tickets:delete
Account segments	account_segments:read, account_segments:write, account_segments:delete

Responder actions such as acknowledging an alert or appending to an incident are separate from configuration and deletion. Give on-call automation the responder scopes it needs, not blanket administration.

Organization, AI, and agents

Resource	Scopes
Settings	settings:read, settings:write, settings:delete
GitHub configuration	github_config:read, github_config:write
Projects and members	projects:write, projects:delete, members:write
Scores and evaluations	scores:read, scores:write, evals:write
Customer Detective	investigations:run
Usage	usage:read
MCP	mcp:read, mcp:write

mcp:write is an umbrella gate. An MCP write also requires its domain scope. For example, creating an incident requires both MCP write access and the incident permission enforced by that tool.

Safe key patterns

• Browser or mobile SDK: project-scoped ingest:write plus analytics:write; add replay:write only when recording browser replay. Browser flag evaluation additionally needs flags:read; treat all flag configuration and payloads as client-visible.
• Server SDK: project-scoped ingest:write, adding analytics:write when it calls identify, group, screen, or diagnostic-event methods.
• OpenTelemetry collector: project-scoped ingest:write only.
• Read-only agent: mcp:read and only the read domains it needs.
• CI symbol upload: dedicated project key with errors:write; add releases:write when the same job also registers a release.
• Operations automation: explicit responder or configuration scopes, fixed project, no unrelated deletes.

The wildcard platform-admin permission is not grantable to API keys.

• Authentication and API keys
• Permissions and safe actions