Check the scopes required by each API route

Use GET /api/openapi?view=scopes to inspect the permissions required by an operation.

• A scoped credential must satisfy the route's declared data permissions; administrative scopes alone do not authorize usage reads.
• Commerce audit access requires audit:read alongside commerce:catalog:read.
• A route that declares no scope does not automatically accept a narrowly scoped agent credential.

If a request is refused, grant only the permissions needed for the intended operation rather than replacing the key with unrestricted access.