Token abilities
Personal access tokens carry a list of abilities (Sanctum token permissions). Tokens can only
include abilities your user role already holds for the organization. Use
* for full access within your role,
or grant specific strings from the table below.
Create tokens in the dashboard at
/settings/api-tokens
or via POST /v1/tokens when your token has
api.tokens.manage.
| Ability | Description | REST endpoints |
|---|---|---|
codes.view |
List and read QR codes, including bulk import status. | GET /v1/qr-codes, GET /v1/qr-codes/{code_ulid}, GET /v1/qr-codes/bulk/{import_ulid} |
codes.create |
Create QR codes and run bulk import staging/confirm. | POST /v1/qr-codes, POST /v1/qr-codes/bulk, POST /v1/qr-codes/bulk/{import_ulid}/confirm |
codes.update |
Update existing QR codes (destination, status, routing, etc.). | PATCH /v1/qr-codes/{code_ulid} |
codes.delete |
Soft-delete QR codes. | DELETE /v1/qr-codes/{code_ulid} |
styles.manage |
List and create QR style presets. | GET /v1/qr-styles, POST /v1/qr-styles |
domains.view |
List organization and fallback redirect domains. | GET /v1/domains |
domains.manage |
Add custom domains and update verification/SSL settings. | POST /v1/domains, PATCH /v1/domains/{domain_ulid} |
analytics.view |
Read scan analytics rollups (org, brand, or code scope). | GET /v1/analytics, GET /v1/analytics/qr-codes/{code_ulid} |
analytics.export |
Export analytics payloads and raw scan rows. | GET /v1/analytics/export, GET /v1/analytics/qr-codes/{code_ulid}/raw-export |
view_organization_analytics |
Dashboard permission for org-wide analytics (assignable on tokens; REST uses analytics.view). | Dashboard / role only |
view_brand_analytics |
Dashboard permission for brand-scoped analytics (assignable on tokens; REST uses analytics.view). | Dashboard / role only |
brands.view |
List brands in the organization. | GET /v1/brands |
brands.manage |
Create and update brands. | POST /v1/brands, PATCH /v1/brands/{brand_ulid} |
stores.view |
Assignable token ability. | Dashboard / role only |
stores.manage |
Assignable token ability. | Dashboard / role only |
stores.manage_content |
Assignable token ability. | Dashboard / role only |
manage_design_policy |
Manage org design policy settings (dashboard; not a REST gate). | Dashboard / role only |
override_locked_design_fields |
Override locked design fields in the dashboard (not a REST gate). | Dashboard / role only |
api.tokens.manage |
List, create, and revoke API tokens; read the assignable ability catalog. | GET /v1/tokens/abilities, GET /v1/tokens, POST /v1/tokens, DELETE /v1/tokens/{token_id} |
wallet.view |
Read prepaid wallet balance and transaction history. | GET /v1/wallet |
mcp.access |
Required on every token used with the MCP server (in addition to tool-specific abilities). | All MCP tool invocations |
MCP tokens
Every MCP client token must include mcp.access in addition to the abilities required
by each tool you call (for example codes.create for codes_create).