Scope reference

The authoritative list is served by the API:

const groups = await client.developer.listScopes();

Scopes are <resource>.<verb> with verbs read, write and delete. Remember that write does not imply read.

Tenant resources

Resource	Covers
operations	Sites, zones, tunnels, lots, production, shifts, custody, tailings
inventory	Stock, materials, equipment, requisitions
workforce	Workers, attendance, contracts, payroll
safety	Incidents, inspections, hazards, corrective actions
incidents	Incident register
environment	Environmental monitoring, samples, thresholds
compliance	Licences, permits, requirements, submissions
finance	Invoices, budgets, transactions
disbursements	Payroll disbursement and provider routing
reporting	Reports, schedules, exports, report builder
dashboards	Dashboard data
users	Users and signing keys
roles	Roles and assignments
permissions	Permission catalog
tenant_config	Tenant settings and hierarchy naming
audit	Tenant audit log
notifications	Notification dispatch and preferences
files	File storage and pre-signed URLs
sync	Offline sync

Platform resources

platform.* covers cross-tenant administration and requires a platform-scoped key, issuable only by a MineTech super-admin. Those endpoints are documented for completeness but are unreachable with a tenant key.

Endpoints a key can never reach

Regardless of scope:

• /v1/auth/* — a key that could mint a session token could escalate itself
• /v1/developer/api-keys/* — a key can never create or modify another key
• Inbound provider webhook receivers — authenticated by their own provider secret
• Health and readiness probes