> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rixapi.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes

> Every Admin Key capability must be ticked explicitly; anything not ticked is refused.

Admin Keys are **deny by default**: only endpoints covered by a scope you explicitly ticked can be called. Everything else is refused.

## The five scopes

| Scope          | What it allows                                                  | Ticked by default |
| -------------- | --------------------------------------------------------------- | ----------------- |
| `account:read` | View account profile and balance                                | Yes               |
| `logs:read`    | View call log statistics and export details                     | Yes               |
| `usage:read`   | Export usage analytics by time, model and other dimensions      | Yes               |
| `keys:read`    | View the API key list and single key details, without plaintext | No                |
| `keys:write`   | Create, update and delete API keys, still without plaintext     | No                |

<Note>
  All three default scopes are read-only. Write access must be ticked by hand, and the interface warns you when you do.
</Note>

## Endpoints covered by each scope

<AccordionGroup>
  <Accordion title="account:read">
    | Method | Path             | Description                        |
    | ------ | ---------------- | ---------------------------------- |
    | `GET`  | `/api/user/self` | Account profile, including balance |
  </Accordion>

  <Accordion title="logs:read">
    | Method | Path                          | Description                       |
    | ------ | ----------------------------- | --------------------------------- |
    | `GET`  | `/api/log/self/stat`          | Call statistics (spend, RPM, TPM) |
    | `GET`  | `/api/log/self/stream-export` | Export log details as CSV         |
  </Accordion>

  <Accordion title="usage:read">
    | Method | Path                                 | Description                   |
    | ------ | ------------------------------------ | ----------------------------- |
    | `GET`  | `/api/data/self/pivot/stream-export` | Export usage analytics as CSV |
  </Accordion>

  <Accordion title="keys:read">
    | Method | Path              | Description        |
    | ------ | ----------------- | ------------------ |
    | `GET`  | `/api/token/`     | API key list       |
    | `GET`  | `/api/token/{id}` | Single key details |
  </Accordion>

  <Accordion title="keys:write">
    | Method   | Path              | Description  |
    | -------- | ----------------- | ------------ |
    | `POST`   | `/api/token/`     | Create a key |
    | `PUT`    | `/api/token/`     | Update a key |
    | `DELETE` | `/api/token/{id}` | Delete a key |
  </Accordion>
</AccordionGroup>

Full parameters and responses are in the [API reference](/docs/en/admin-key/api-reference).

## Refusal responses

There are two kinds of refusal, and the difference is **whether ticking another scope fixes it**.

### Missing scope

The endpoint is available to Admin Keys, but this key does not have the required scope. **Edit the key and tick it.**

```json theme={null}
{
  "success": false,
  "code": "admin_key_scope_missing",
  "message": "The admin key is missing the required scope: keys:read"
}
```

The `message` names the scope that is missing.

### Endpoint not available

This endpoint is not available to Admin Keys at all. **No scope will help** — sign in to the console instead.

```json theme={null}
{
  "success": false,
  "code": "admin_key_scope_forbidden",
  "message": "This endpoint is not available to admin keys, sign in to the console instead"
}
```

Admin, agent and supplier endpoints return the same code with wording that says so explicitly.

<Warning>
  Using an Admin Key against `/v1/chat/completions` returns a dedicated message rather than a vague "invalid token". Seeing it means you reached for the wrong credential type.
</Warning>