Scopes

Scope	Grants
api:discovery	GET /v1
customers:read	Read customers and departments
customers:write	Create/update customers and departments
events:read	Read the event feed (GET /v1/events)
invoices:read	Read invoices, PDFs and timelines
invoices:write	Create drafts, issue, send, delete drafts
members:read	Read members and the role catalogue
members:manage	Assign member roles (privilege-escalation surface — grant sparingly)
payments:read	Read payments and receipts
payments:write	Register manual payments
products:read	Read products and the chart of accounts
products:write	Create/update products and accounts
reminders:read	Read reminder history and settings
reminders:write	Send ad-hoc reminders, configure reminder settings and flows
settings:read	Read organisation settings (numbering, tone, payment methods)
settings:write	Write branding, payment domain and customer-portal settings
subscriptions:read	Read subscriptions, their invoices and previews
subscriptions:write	Create/update subscriptions, transitions, run now
cases:read	Read collection cases
cases:write	Create collection cases
settlements:read	Read settlement history (GET /v1/settlements)
terms:accept	Submit terms-acceptance evidence
webhooks:manage	Administer webhook endpoints, rotate secrets, test, replay

Grant a key only the scopes it needs.

Legacy scope names (sager:read, sager:write, afregninger:read, betingelse:accept) remain valid as aliases on already-issued keys — new keys use the names above.