Scopes - ePhone AI Docs

The five scopes

Scope	What it allows	Ticked by default
`account:read`	View account profile and balance	Yes
`logs:read`	View call log statistics and export details	Yes
`usage:read`	Export usage analytics by time, model and other dimensions	Yes
`keys:read`	View the API key list and single key details, without plaintext	No
`keys:write`	Create, update and delete API keys, still without plaintext	No

All three default scopes are read-only. Write access must be ticked by hand, and the interface warns you when you do.

Endpoints covered by each scope

account:read

Method	Path	Description
`GET`	`/api/user/self`	Account profile, including balance

logs:read

Method	Path	Description
`GET`	`/api/log/self/stat`	Call statistics (spend, RPM, TPM)
`GET`	`/api/log/self/stream-export`	Export log details as CSV

usage:read

Method	Path	Description
`GET`	`/api/data/self/pivot/stream-export`	Export usage analytics as CSV

keys:read

Method	Path	Description
`GET`	`/api/token/`	API key list
`GET`	`/api/token/{id}`	Single key details

keys:write

Method	Path	Description
`POST`	`/api/token/`	Create a key
`PUT`	`/api/token/`	Update a key
`DELETE`	`/api/token/{id}`	Delete a key

Full parameters and responses are in the API reference.

Refusal responses

There are two kinds of refusal, and the difference is whether ticking another scope fixes it.

Missing scope

The endpoint is available to Admin Keys, but this key does not have the required scope. Edit the key and tick it.

{
  "success": false,
  "code": "admin_key_scope_missing",
  "message": "The admin key is missing the required scope: keys:read"
}

The message names the scope that is missing.

Endpoint not available

This endpoint is not available to Admin Keys at all. No scope will help — sign in to the console instead.

{
  "success": false,
  "code": "admin_key_scope_forbidden",
  "message": "This endpoint is not available to admin keys, sign in to the console instead"
}

Admin, agent and supplier endpoints return the same code with wording that says so explicitly.

Using an Admin Key against /v1/chat/completions returns a dedicated message rather than a vague “invalid token”. Seeing it means you reached for the wrong credential type.

​The five scopes

​Endpoints covered by each scope

​Refusal responses

​Missing scope

​Endpoint not available

The five scopes

Endpoints covered by each scope

Refusal responses

Missing scope

Endpoint not available