api.botsubscription.com

GET/v1/endpoint

AuthenticationBearer

Token

Stays in this tab. Required for this endpoint — the value below is what gets sent.

Path parameters0

Query parameters0

BodyJSON

Mock

curl --request GET \
  --url https://api.botsubscription.com/v1/endpoint \
  --header 'Authorization: Bearer sk_live_•••'

List API Key Scopes - Discover Available Key Permissions

Get the full registry of scopes you can grant when creating a restricted API key. Read this list instead of hardcoding scope identifiers in your integration—a newly added scope appears here automatically, with no client-side change needed.

GET/v2/projects/{project_id}/integrations/api-keys/scopes

Authorization

Bearer TokenRequired

Requires the settings:read permission, the same gate as listing keys. This endpoint returns no key material. A scoped (restricted) API key cannot call this route—scope discovery is for dashboard and integration-setup callers using a full-access token.

Path Parameters

project_idstringrequired

The unique identifier of the project.

curl -X GET "https://api.botsubscription.com/v2/projects/YOUR_PROJECT_ID/integrations/api-keys/scopes" \
  -H "Authorization: Bearer YOUR_TOKEN"

const project_id = 'YOUR_PROJECT_ID';
const response = await fetch(`https://api.botsubscription.com/v2/projects/${project_id}/integrations/api-keys/scopes`, {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_TOKEN'
  }
});
const data = await response.json();

import requests
 
project_id = 'YOUR_PROJECT_ID'
response = requests.get(
    f'https://api.botsubscription.com/v2/projects/{project_id}/integrations/api-keys/scopes',
    headers={'Authorization': 'Bearer YOUR_TOKEN'}
)
data = response.json()

$project_id = 'YOUR_PROJECT_ID';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api.botsubscription.com/v2/projects/{$project_id}/integrations/api-keys/scopes");
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer YOUR_TOKEN']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

Successapplication/json

{
  "ok": true,
  "request_id": "11111111-1111-1111-1111-111111111111",
  "method": "GET",
  "path": "/v2/projects/YOUR_PROJECT_ID/integrations/api-keys/scopes",
  "code": 200,
  "data": {
    "scopes": [
      {
        "id": "plans:read",
        "description": "Read membership plans — buyer-eligibility view only (GET /v2/projects/:projectId/plans)",
        "realm": "project",
        "surface": "rest"
      },
      {
        "id": "payment-requests:add",
        "description": "Create payment requests for this project",
        "realm": "project",
        "surface": "rest"
      },
      {
        "id": "mcp:plans:read",
        "description": "MCP tool access for the 'plans:read' capability (Model Context Protocol surface only; grants no REST endpoint access)",
        "realm": "project",
        "surface": "mcp"
      }
    ]
  }
}

Each entry's realm tells you which key store the scope belongs to—project, central, or both—and surface tells you whether it grants REST access, an MCP tool, or both. Creating or regenerating a key with a scope from the wrong realm is rejected with 422 VALIDATION_ERROR.

Last updated: August 31, 2026