Scopes

Implemented scopes:

spaces:read permits GET /spaces, GET /spaces/{space_id}, and GET /spaces/{space_id}/children. It also covers the website-mode reads: GET /spaces/{space_id}/website, GET /spaces/{space_id}/share_block_configs[/{id}], and GET /spaces/{space_id}/navbar_configs[/{id}].
membership_spaces:read permits GET /me/membership_spaces, which lists only basic metadata for the token user's own membership spaces and the token user's own membership state.
members:read permits member reads plus CRM contact reads: GET /members, GET /spaces/{space_id}/members, GET /spaces/{space_id}/members/{member_id}, GET /spaces/{space_id}/contacts, and GET /spaces/{space_id}/contacts/{contact_id}.
members.email:read permits exact-match email filtering and includes member/contact email addresses in responses.
member_properties:read permits member property definition reads and member/contact list filtering by property values. Member and contact property value reads also require members:read.
space_properties:read permits space property definition reads. Space property value reads also require spaces:read.
invitations:read permits invitation list/show endpoints.
content:read permits content block list/show endpoints, Tiptap document reads, and registration page draft/live reads.
messages:read permits message list/show endpoints.
reflections:read permits reflection list/show endpoints.
surveys:read permits survey list/show endpoints.
survey_submissions:read permits grouped survey submission read endpoints.
plans:read permits plan list/show endpoints.
enrollments:read permits enrollment list/show endpoints.
payments:read permits payment list/show endpoints.
coupons:read permits coupon list/show endpoints.
broadcasts:read permits broadcast list/show endpoints.
automations:read permits automation list/show, automation member list/show, step list (GET /automations/{automation_id}/steps), and the GET /automations/capabilities discovery endpoint.
design:read permits design capability and current page-design reads.
media:read permits Admin media upload/status reads.

Implemented write scopes:

spaces:write permits space create/update/delete plus child creation, attachment, detachment, placement updates, and reordering. It also covers the space configuration endpoints: behavioral settings (PATCH /spaces/{space_id}/settings), appearance (PATCH /spaces/{space_id}/appearance), images (POST /spaces/{space_id}/images), the paid-access gate (PATCH /spaces/{space_id}/payment), and website mode (PATCH /spaces/{space_id}/website) together with its header/footer share blocks (POST|PATCH|DELETE /spaces/{space_id}/share_block_configs[/{id}]) and navbars (POST|PATCH|DELETE /spaces/{space_id}/navbar_configs[/{id}], plus /duplicate). Enabling website mode requires the Silver plan or above on the space's top-level account.
members:write permits member create/update/approve/delete, member bulk operations, and contact property-value updates.
member_properties:write permits member property definition mutations. Member and contact property value updates also require members:write.
space_properties:write permits space property definition mutations. Space property value updates also require spaces:write.
invitations:write permits invitation create/update/delete/resend and invitation bulk create.
content:write, messages:write, and reflections:write permit content block, Tiptap document, registration page draft, message, and reflection mutations. Use document endpoints for new visible content workflows; content block writes are the legacy mirror surface. Publishing a registration page also requires spaces:write because it enables the registration gate on the space.
media:write permits Admin media upload session creation, completion, cancellation, and external media reference creation.
surveys:write, plans:write, coupons:write, and broadcasts:write permit their matching domain mutations. plans:write manages plan pricing only — the space-level paid-access gate is written exclusively through PATCH /spaces/{space_id}/payment under spaces:write, so a plans-only token can never flip a space into or out of paid access.
broadcasts:send permits POST /broadcasts/{broadcast_id}/send.
automations:write permits adding and removing members from automations.
automations:manage permits automation authoring: create/update/delete automations and full step authoring — create/update/reorder/delete steps and the one-shot POST /automations/{automation_id}/steps/replace graph — including conditional logic and branching. Structural editing is gated separately from automations:write (member enrollment) because of its larger blast radius: an automations:manage token can rewrite flows, create webhook steps that POST member data to arbitrary URLs, and delete automations (cancelling in-flight enrollments when force=true). Conditional steps require the Silver plan or above on the space's top-level account (Silver allows one per automation; Gold and above are unlimited). The survey condition category, the survey_completed trigger, google_calendar_invite, and issue_certificate are not authorable via the Admin API yet.
design:write permits design validation and draft creation/update.
design:publish permits publishing and restoring design drafts.
assets:write permits design asset import.

By default, an API token can access every space that the token user can manage — including archived spaces (so archiving is reversible through the API) and pending spaces (scheduled to launch). Sutra can optionally restrict a token to specific spaces. Those token-level restrictions are exact: restricting a token to a child space does not include that child's descendants.