Permissions and access
The token's permissions and the person's own access, together.
What a request may do is decided twice: by the permissions the token carries, and by the person's own access. It needs both.
TokenCarries
invoice.write?RoleTheir role may make invoices?
Branch & territoryThat customer and branch are theirs?
ApprovalsOver a limit? It waits for an approver.
So a sales rep's token with invoice.read lists only the invoices of their branches and territory, exactly as their ZiloInvoice pages do; an accountant's token sees more. A permission is a ceiling, never more than the person has.
What each answer means#
403 insufficient_scope: the token lacks the permission (details.scopesays which). Ask for it when signing in.403 forbidden: the person's role doesn't allow it. No token fixes that; an admin changes roles in Control.404 not_found: nothing with that id that this person can see (another branch's invoice looks the same as one that doesn't exist).202: it waits for approval (see Approvals).
All permissions#
Ask only for what your app uses: the consent screen lists them, grouped by app. Apps with API permissions always get refresh tokens.
ZiloMail#
mail.read | Read mail | Mailboxes, folders, messages, attachments and what changed. |
mail.write | Organise mail | Mark read or starred, move, delete, folders and drafts. |
mail.send | Send mail | Send email and check delivery status. |
Calendar#
calendar.read | Read calendar | Events in their calendar. |
calendar.write | Manage calendar | Add, change and remove events (guests are invited by mail). |
Contacts#
contacts.read | Read contacts | Their address book. |
contacts.write | Manage contacts | Add, change and remove contacts. |
ZiloDrive#
drive.read | Read ZiloDrive | List, search and download files and folders. |
drive.write | Write ZiloDrive | Upload files (virus-scanned), make folders, rename, move and move to Trash. |
People#
users.read | Read people | The organisation's people: names, addresses, job titles. |
ZiloInvoice#
invoice.read | Read sales | Customers, products, invoices and receipts. |
invoice.write | Record sales | Add and change customers and products, make invoices, record receipts. |
ZiloInventory#
inventory.read | Read stock | Warehouses and stock on hand. |
ZiloHR#
hr.read | Read HR | Employees, attendance and leave. |
hr.attendance | Mark attendance | Mark attendance and record check-in / check-out. |
hr.leave | Ask for leave | Apply for leave (it goes through the usual approvals). |
ZiloCRM#
crm.read | Read CRM | Leads, deals and activities. |
crm.write | Manage CRM | Add and change leads and deals, log activities. |
ZiloProjects#
projects.read | Read projects | Projects and tasks. |
projects.write | Manage tasks | Add and change tasks. |
ZiloDesk#
desk.read | Read tickets | Support tickets and their conversations. |
desk.write | Work on tickets | Open tickets, reply, change status, priority and who has them. |
users.write (adding people) is for organisation keys only, on the first API. Organisation admins manage people in Control.