Scopes & Permissions

Access to each endpoint is gated by a scope. Your partner credential is provisioned with a set of scopes; if a call’s required scope is not in that set, the API returns 403 INSUFFICIENT_SCOPE. Scopes follow a resource.action pattern, where action is read or write. A write scope covers create, update, and delete for that resource.

Available scopes

Scope	Grants
`tours.read`	Read tour data, the reference-data lookups, the whole-tour read, the day sheet, and the tour file listing and downloads
`tours.write`	Create, edit, and soft-delete tours
`schedule.read`	Read schedule items, their custom fields, tags, and schedule templates
`schedule.write`	Create, update, and delete schedule items, their custom fields, tags, and schedule templates; apply a template to a day; upload and attach files
`venues.read`	Read venues, their custom fields, and their contacts
`venues.write`	Create, update, and delete venues, their custom fields, and their contacts
`guestlist.read`	Read guest lists, the approved-guest total, pass types, and requesters
`guestlist.write`	Add, edit, delete, restore, and bulk-restatus guest list entries; configure a day’s guest list; create, update, delete, and restore pass types
`bulletins.read`	Read bulletins
`bulletins.write`	Create, update, and delete bulletins
`accommodation.read`	Read stays, their rooms, custom fields, and contacts
`accommodation.write`	Create, edit, and delete stays, rooms, contacts, and the organization contact book
`organization.read`	Read organization info, members, and the key-contact book
`users.read`	Read tour member info
`chat.read`	Read chat history — channels and group chats only

There is no chat.write. The Integration API exposes chat history only — it cannot post, edit, or delete messages, and it never returns 1:1 direct messages. See Chat.

Endpoints that need more than one scope

Almost every endpoint requires exactly one scope. The exceptions are the reads that span several resources in a single response, and therefore require the read scope for all of them:

Endpoint	Requires
`GET /v1/tours/{tourId}/data`	`tours.read` + `schedule.read` + `venues.read` + `accommodation.read` + `guestlist.read` + `bulletins.read`
`GET /v1/tours/{tourId}/days/{dayId}/day-sheet/data`	the same six
`POST /v1/tours/{tourId}/days/{dayId}/day-sheet`	the same six
`GET /v1/tours/{tourId}/files`	`tours.read` + `schedule.read` + `venues.read` + `accommodation.read` + `guestlist.read`
`GET /v1/tours/{tourId}/files/{fileId}/download`	the same five

The two file endpoints do not require bulletins.read, because bulletins do not support attachments and so can never appear in a file listing. If any one is missing the response is 403 INSUFFICIENT_SCOPE, and the message names exactly which:

{
  "error": "INSUFFICIENT_SCOPE",
  "message": "This endpoint returns data from several resources and requires all of: tours.read, schedule.read, venues.read, accommodation.read, guestlist.read, bulletins.read. Missing: bulletins.read",
  "status": 403
}

Scope per endpoint

Endpoint	Scope
`GET /v1/organizations`	`organization.read`
`GET /v1/organizations/{orgId}/key-contacts`	`organization.read`
`GET /v1/organizations/{orgId}/users`	`organization.read`
`GET /v1/tours/{tourId}/users`	`users.read`
`GET /v1/day-types`	`tours.read`
`GET /v1/reference/types`	`tours.read`
`GET /v1/tours`	`tours.read`
`GET /v1/tours/{tourId}/data`	`tours.read` + `schedule.read` + `venues.read` + `accommodation.read` + `guestlist.read` + `bulletins.read`
`GET /v1/tours/{tourId}/days/{dayId}/day-sheet/data`	`tours.read` + the other five reads
`POST /v1/tours/{tourId}/days/{dayId}/day-sheet`	`tours.read` + the other five reads
`GET /v1/tours/{tourId}/files`	`tours.read` + `schedule.read` + `venues.read` + `accommodation.read` + `guestlist.read`
`GET /v1/tours/{tourId}/files/{fileId}/download`	`tours.read` + the other four reads
`POST /v1/tours`	`tours.write`
`PUT /v1/tours/{tourId}`	`tours.write`
`DELETE /v1/tours/{tourId}`	`tours.write`
`GET /v1/schedule/items/{itemId}/custom-fields`	`schedule.read`
`GET /v1/schedule-templates/{templateId}/items`	`schedule.read`
`GET /v1/tours/{tourId}/days/{dayId}/schedule`	`schedule.read`
`GET /v1/tours/{tourId}/schedule-templates`	`schedule.read`
`GET /v1/tours/{tourId}/tags`	`schedule.read`
`GET /v1/tours/{tourId}/tags/{tagId}/usage`	`schedule.read`
`POST /v1/attachments`	`schedule.write`
`POST /v1/tours/{tourId}/files/content`	`schedule.write`
`POST /v1/tours/{tourId}/files/upload-ticket`	`schedule.write`
`POST /v1/tours/{tourId}/files/attach`	`schedule.write`
`POST /v1/schedule/items`	`schedule.write`
`PUT /v1/schedule/items/{itemId}`	`schedule.write`
`DELETE /v1/schedule/items/{itemId}`	`schedule.write`
`PUT /v1/schedule/items/{itemId}/custom-fields`	`schedule.write`
`POST /v1/schedule/items/{itemId}/restore`	`schedule.write`
`PUT /v1/schedule/items/{itemId}/tags`	`schedule.write`
`POST /v1/schedule/items/batch`	`schedule.write`
`POST /v1/schedule-templates`	`schedule.write`
`PUT /v1/schedule-templates/{templateId}`	`schedule.write`
`DELETE /v1/schedule-templates/{templateId}`	`schedule.write`
`POST /v1/schedule-templates/{templateId}/restore`	`schedule.write`
`POST /v1/schedule-templates/{templateId}/apply`	`schedule.write`
`POST /v1/schedule-templates/{templateId}/undo-apply`	`schedule.write`
`POST /v1/tours/{tourId}/days/{dayId}/confirm-all`	`schedule.write`
`POST /v1/tours/{tourId}/tags`	`schedule.write`
`PUT /v1/tours/{tourId}/tags/{tagId}`	`schedule.write`
`DELETE /v1/tours/{tourId}/tags/{tagId}`	`schedule.write`
`GET /v1/reference/age-restrictions`	`venues.read`
`GET /v1/reference/venue-field-templates`	`venues.read`
`GET /v1/tours/{tourId}/venues`	`venues.read`
`GET /v1/venues/{venueId}`	`venues.read`
`GET /v1/venues/{venueId}/contacts`	`venues.read`
`GET /v1/venues/{venueId}/custom-fields`	`venues.read`
`GET /v1/venues/{venueId}/key-contacts`	`venues.read`
`POST /v1/venues`	`venues.write`
`PUT /v1/venues/{venueId}`	`venues.write`
`DELETE /v1/venues/{venueId}`	`venues.write`
`PUT /v1/venues/{venueId}/contacts`	`venues.write`
`PUT /v1/venues/{venueId}/custom-fields`	`venues.write`
`PUT /v1/venues/{venueId}/key-contacts`	`venues.write`
`GET /v1/accommodation/{accommodationId}`	`accommodation.read`
`GET /v1/accommodation/{accommodationId}/contacts`	`accommodation.read`
`GET /v1/accommodation/{accommodationId}/custom-fields`	`accommodation.read`
`GET /v1/accommodation/{accommodationId}/key-contacts`	`accommodation.read`
`GET /v1/accommodation/{accommodationId}/rooms`	`accommodation.read`
`GET /v1/reference/stay-field-templates`	`accommodation.read`
`GET /v1/tours/{tourId}/accommodation`	`accommodation.read`
`POST /v1/accommodation`	`accommodation.write`
`PUT /v1/accommodation/{accommodationId}`	`accommodation.write`
`DELETE /v1/accommodation/{accommodationId}`	`accommodation.write`
`PUT /v1/accommodation/{accommodationId}/contacts`	`accommodation.write`
`PUT /v1/accommodation/{accommodationId}/custom-fields`	`accommodation.write`
`PUT /v1/accommodation/{accommodationId}/key-contacts`	`accommodation.write`
`POST /v1/accommodation/{accommodationId}/rooms`	`accommodation.write`
`POST /v1/key-contacts`	`accommodation.write`
`PUT /v1/key-contacts/{keyContactId}`	`accommodation.write`
`PUT /v1/rooms/{roomAssignmentId}`	`accommodation.write`
`DELETE /v1/rooms/{roomAssignmentId}`	`accommodation.write`
`POST /v1/rooms/{roomAssignmentId}/restore`	`accommodation.write`
`GET /v1/tours/{tourId}/days/{dayId}/guestlist`	`guestlist.read`
`GET /v1/tours/{tourId}/days/{dayId}/guestlist/approved-count`	`guestlist.read`
`GET /v1/tours/{tourId}/passTypes`	`guestlist.read`
`GET /v1/tours/{tourId}/requesters`	`guestlist.read`
`POST /v1/guestlist`	`guestlist.write`
`PUT /v1/guestlist/{guestListId}`	`guestlist.write`
`DELETE /v1/guestlist/{guestListId}`	`guestlist.write`
`POST /v1/guestlist/{guestListId}/restore`	`guestlist.write`
`PUT /v1/tours/{tourId}/days/{dayId}/guestlist/config`	`guestlist.write`
`PUT /v1/tours/{tourId}/guestlist/status`	`guestlist.write`
`POST /v1/tours/{tourId}/passTypes`	`guestlist.write`
`PUT /v1/passTypes/{passTypeId}`	`guestlist.write`
`DELETE /v1/passTypes/{passTypeId}`	`guestlist.write`
`POST /v1/passTypes/{passTypeId}/restore`	`guestlist.write`
`GET /v1/tours/{tourId}/bulletins`	`bulletins.read`
`POST /v1/bulletins`	`bulletins.write`
`PUT /v1/bulletins/{bulletinId}`	`bulletins.write`
`DELETE /v1/bulletins/{bulletinId}`	`bulletins.write`
`GET /v1/tours/{tourId}/chat/enabled`	`chat.read`
`GET /v1/tours/{tourId}/chat/conversations`	`chat.read`
`GET /v1/tours/{tourId}/chat/search`	`chat.read`
`GET /v1/chat/conversations/{conversationId}`	`chat.read`
`GET /v1/chat/conversations/{conversationId}/members`	`chat.read`
`GET /v1/chat/conversations/{conversationId}/messages`	`chat.read`
`GET /v1/chat/conversations/{conversationId}/pinned`	`chat.read`
`GET /v1/chat/conversations/{conversationId}/files`	`chat.read`
`GET /v1/chat/messages/{messageId}/replies`	`chat.read`
`GET /v1/chat/messages/{messageId}/reactions`	`chat.read`

102 endpoints.

Two kinds of permission

Two independent checks apply to every call:

Partner scope — does your application hold the scope for this endpoint? Decided by the scopes on your partner credential.
User access — can the authenticated user see or modify this specific resource? Decided by the user’s roles and membership inside Daysync. Even with the right scope, a request can be rejected because the user lacks access to that tour or organization.

A partner can be provisioned with any subset of scopes (for example, a read-only integration with just tours.read, schedule.read, and organization.read). See Apply for API Access to request a credential and the scopes your integration needs.

Get started

Endpoints

Guides

Reference

Available scopes

Endpoints that need more than one scope

Scope per endpoint

Two kinds of permission

​Available scopes

​Endpoints that need more than one scope

​Scope per endpoint

​Two kinds of permission

Available scopes

Endpoints that need more than one scope

Scope per endpoint

Two kinds of permission