Permissions
Every API key carries permissions, and every request it makes is checked against them. A key holds only what it was given: the key in a publishing script cannot read your invoices, and no key at all can create another key, sign anybody in, or reach another workspace.
Permissions come in two words per area. Write includes read, so a key that may change a thing can always see it.
The areas are grouped and ordered exactly as the dashboard's side menu is, so the picker on the screen and this page read the same way.
Overview
| Area | Read | Write | What it covers |
|---|---|---|---|
| Posts | posts:read | posts:write | Every posting job from arrival to published, including cancelling and deleting one. |
| Posts - Approvals | approvals:read | approvals:write | Clearing or refusing a post that is waiting on a person. |
| Schedule | schedule:read | -- | The posting calendar: what is due to go out, and when. |
Library
| Area | Read | Write | What it covers |
|---|---|---|---|
| Templates | templates:read | templates:write | The templates a clip can be drawn with, their variants and the formats they come in. |
| Templates - Direct export | renders:read | renders:write | Rendering a clip on its own and downloading it, without a post going anywhere. |
| Media | media:read | media:write | Images, video, sound and fonts, and the clips a render produced. |
Publication
| Area | Read | Write | What it covers |
|---|---|---|---|
| Brands | brands:read | brands:write | Brand documents: names, colours, logos, disclaimers and the text that goes out with a post. |
| Channels | channels:read | channels:write | The accounts posts go to, what each one listens to, and the credentials it publishes with. |
| Syndication | syndication:read | syndication:write | Handing a channel's finished posts on to partners, so their audience gets your clips. |
Content sources
| Area | Read | Write | What it covers |
|---|---|---|---|
| Feeds | feeds:read | feeds:write | The feeds Reelwire carries and which of them this workspace uses. |
| Manual post lists | postlists:read | postlists:write | Scheduled manual posts: the lists and the posts waiting in them. |
| Custom feeds | streams:read | streams:write | Your own data streams: making them, naming what they carry, and mapping their fields. |
| Custom feeds - Send raw data | -- | ingest:write | Push events into your custom feeds. This is what a producer or a trading system uses. |
Connections
| Area | Read | Write | What it covers |
|---|---|---|---|
| Publishing | connections:read | connections:write | How finished posts reach the platforms: the connection mode, the connector, and what was delivered. |
| Publishing - Webhooks | webhooks:read | webhooks:write | Where Reelwire tells you things happened, and what it has tried to deliver. |
| Received | received:read | -- | What arrived, what it was matched to, and what it produced or why it produced nothing. |
Performance
| Area | Read | Write | What it covers |
|---|---|---|---|
| Analytics | analytics:read | -- | How posts have performed over time: reach, views and what each channel returned. |
| A/B tests | abtests:read | -- | Which variants were tried against each other, and which of them won. |
My account
| Area | Read | Write | What it covers |
|---|---|---|---|
| Team | team:read | team:write | The colleagues in this workspace, what each may do, and inviting or removing one. |
Subscription
| Area | Read | Write | What it covers |
|---|---|---|---|
| Allowance | allowance:read | -- | How many renders this month holds and how many are left. |
| Plan | plan:read | -- | Which tier this workspace is on and what that tier switches on. |
Syndication is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.
Analytics is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.
A/B tests is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.
Team is only offered to workspaces whose plan includes it. On every other plan it is absent from the picker, and a key cannot hold it.
Ready-made sets
The screen offers these as a starting point. They are ordinary permission lists: pick one, then narrow it.
Send raw data
For a producer or a trading system that only pushes events in.
ingest:write
Make and publish posts
Everything needed to create content and get it out: posts, post lists, media, renders.
posts:write
postlists:write
media:write
renders:write
templates:read
brands:read
channels:read
Read only
Reporting and dashboards: sees everything the workspace has, changes nothing.
posts:read
approvals:read
schedule:read
templates:read
renders:read
media:read
brands:read
channels:read
syndication:read
feeds:read
postlists:read
streams:read
connections:read
webhooks:read
received:read
analytics:read
abtests:read
team:read
allowance:read
plan:read
Run the whole workspace
Full configuration by machine. It still cannot create keys or sign anybody in.
posts:read
posts:write
approvals:read
approvals:write
schedule:read
templates:read
templates:write
renders:read
renders:write
media:read
media:write
brands:read
brands:write
channels:read
channels:write
syndication:read
syndication:write
feeds:read
feeds:write
postlists:read
postlists:write
streams:read
streams:write
ingest:write
connections:read
connections:write
webhooks:read
webhooks:write
received:read
analytics:read
abtests:read
team:read
team:write
allowance:read
plan:read
When a key is refused
A request a key may not make is answered with 403 and a body that names the permission and the fix, rather than a scope string you would have to look up:
{
"type": "https://reelwire.io/problems/forbidden",
"title": "Forbidden",
"status": 403,
"detail": "This key may not write here. Give it the \"Media: write\" permission, or use a key that has it."
}