# Scopes

Each credential is granted a set of **scopes** that defines what it can do. Every endpoint requires a specific scope; the token can only run an operation if the credential holds the matching scope. The principle is least privilege: request only what your integration needs.

| Scope | Allows |
|---|---|
| `account:read` | List and detail accounts, check balance and read the account audit trail |
| `statement:read` | Query statement and get receipt |
| `fee:read` | Query the fee catalog and the charged fees |
| `pix:read` | Query DICT keys, look up an external key, PIX status, refund trail, charge status, claim status and query and list MED interventions and DICT infractions |
| `pix:write` | Register and delete DICT key, send and refund PIX, create charges, decode BR Code, claim key portability, operate MED interventions (open, cancel, funds return) and DICT infractions (report, cancel, defense) |
| `transfer:read` | Transfer status, list received TEDs and list favorites |
| `transfer:write` | Send TED, internal transfer, refund a received TED and create or delete favorite |
| `customer:create` | Create customer |
| `customer:read` | Read customer |
| `webhook:read` | List and detail webhooks and read the event catalog |
| `webhook:write` | Register, update, delete, rotate secret, test and replay webhooks |

The scope granted in the token is the intersection of the requested scopes with the credential's permissions. If a call requires a scope the credential does not hold, the response is `403`, indicating the required permission.