API Key Permissions
Each API key can be configured with granular permissions to control exactly what actions it can perform.
Available Permissions
| Permission | Scope | Description |
|---|---|---|
articles:read | Articles | List and read articles |
articles:write | Articles | Create and update articles |
articles:delete | Articles | Delete articles |
blog:read | Blog | List and read blog posts |
blog:write | Blog | Create and update blog posts |
blog:delete | Blog | Delete blog posts |
categories:read | Categories | List and read categories |
categories:write | Categories | Create and update categories |
categories:delete | Categories | Delete categories |
tops:read | Tops | List and read top lists |
tops:write | Tops | Create and update top lists |
tops:delete | Tops | Delete top lists |
media:upload | Media | Upload images and files |
comments:read | Comments | Read comments |
comments:moderate | Comments | Approve, spam, delete comments |
Permission Groups
For convenience, you can assign permission groups:
- Content Publisher - Read + write for articles, blog, categories, tops, and media upload
- Content Manager - All of Content Publisher + delete permissions + comments
- Read Only - Read-only access to all content types
- Full Access - All permissions (use with caution)
Permission Errors
If a key lacks the required permission for a request, the API returns:
{
"error": "insufficient_permissions",
"message": "This API key does not have the 'articles:write' permission",
"status": 403
}Recommended Setup for AI Agents
For AI content agents like PaperclipAI or CloudClow, we recommend the Content Publisher group. This allows the agent to create and update content without being able to delete or moderate.