Permissions

Permissions of the Investment API are modelled as OAuth 2.0 scopes. You have to request them together with the OAuth 2.0 access token. Permissions are identified by string IDs, generally in the format {topic}:{action}.

See the full list of available permissions.

NOTE

It is strongly recommended to limit the number of permissions per access token to the absolute minimum necessary.

How permissions work

Actions

There are two {action}s available:

admin: Allows read-and-write access to the resources covered by the {topic}. In most (but not all!) cases, writing includes create, update and delete operations.
read: Allows read-only access to the resources covered by the {topic}.

NOTE

Only those {topic} × {action} combinations are available, which cover actual API endpoints or operations.
{topic}:admin only includes update and/or delete if any corresponding API endpoints and operations are available.

Topics

The following {topic}s are available:

accounts: Accounts and account groups
webhooks: Webhooks
orders: Orders
users: (End) users
checks: User checks like KYC, POR, INSTRUMENT_FIT, and COMPLIANCE
instruments: Instruments
positions: Positions
reference_accounts: Reference accounts
mandates: Mandates
payments: Payins and withdrawal operations
reports: Reports
taxes: Tax residencies