Integrations
Scopes
The nine scopes an integration can hold, and their enforcement status.
A scope is a permission. You choose the scopes of an integration when you create it, and you can change them later. The selected scopes are stored with the integration. Enforcement per endpoint is announced on that endpoint's page and in the Changelog.
| Scope | Name in the web app | Meaning | Enforced on endpoints |
|---|---|---|---|
market.read | View market info | Read information about the market. | Not yet |
branches.read | View branches | Read the market's branches. | Not yet |
menu.read | View menu | Read menu data. | Not yet |
menu.write | Manage menu | Change menu data. | Not yet |
orders.read | View orders | Read orders. | Not yet |
orders.write | Manage orders | Change orders. | Not yet |
customers.read | View customers | Read customers. | Not yet |
inventory.read | View inventory | Read inventory. | Not yet |
reports.read | View reports | Read reports. | Not yet |
"Not yet" means no endpoint checks that scope today, because no endpoint accepts an integration token. See Overview.
Rules
- Scope keys are fixed. A request that contains an unknown key, or the same key
twice, is rejected with
422. - An integration may hold no scopes. It is created that way if you send none. Such an integration is granted nothing.
- A
readscope does not grant the matchingwritescope, and the reverse. - Editing scopes replaces the whole list and does not change the client secret.
- Removing a scope immediately revokes every access token already issued to the integration, so the client must request a new token. Adding scopes keeps issued tokens valid.
Grant the smallest set the system needs. See Security best practices.