API reference

Scopes & bundles

Scope format

Scopes follow the pattern {actor}:{resource}:{action}. Requests missing a required scope fail with 403 insufficient_scope.

brand:programs:read
brand:submissions:review
brand:ads:launch
partner:finance:reconcile
creator:programs:apply
creator:finance:payouts
mcp:tools:call

All scopes

Brand and partner tokens share the same resource set — prefix each row with brand: or partner::

Resource	Actions
`organization`	`read`, `write`, `members`, `admin`
`partners`	`read`, `write`, `invite`
`creator`	`read`, `write`, `invite`
`programs`	`read`, `write`, `review`
`submissions`	`read`, `write`, `review`, `media`
`ads`	`read`, `write`, `launch`
`finance`	`read`, `write`, `payouts`, `reconcile`
`products`	`read`, `write`, `samples`
`analytics`	`read`, `export`
`integrations`	`read`, `write`, `oauth`

Creator tokens cover the creator's own data — prefix with creator::

Resource	Actions
`creator`	`read`, `write`, `delete`
`programs`	`read`, `apply`
`submissions`	`read`, `write`, `media`
`products`	`read`, `samples`
`finance`	`read`, `payouts`
`analytics`	`read`
`integrations`	`read`, `write`, `oauth`

MCP tokens cover tool discovery and invocation — prefix with mcp::

Resource	Actions
`tools`	`read`, `call`
`resources`	`read`

Wildcards

Three wildcard forms are supported: actor:resource:* grants every action on one resource, actor:*:read grants read across an actor's resources, and actor:*:* grants everything for that actor. write, manage, and admin implicitly satisfy read on the same resource. Wildcards never cross actor types.

Bundles

Named bundles group common grants:

Bundle	Grants	Description
`brand.read`	`brand:*:read`	Read-only brand API access
`brand.manage`	`brand::`	Full brand workspace API access
`partner.read`	`partner:*:read`	Read-only partner API access
`partner.manage`	`partner::`	Full partner API access
`creator.read`	`creator:*:read`	Read-only creator API access
`creator.manage`	`creator::`	Full creator API access
`mcp.read`	`mcp:tools:read`, `mcp:resources:read`	Read-only MCP tool discovery
`mcp.call`	`mcp:tools:read`, `mcp:tools:call`	MCP tool invocation

You can inspect the full taxonomy — every scope with its description, plus bundles and wildcard rules — without authentication:

curl https://api.onlucra.com/v1/scopes