> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wristler.eu/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes

> What a token may do, and which kinds of client may ask for what.

A scope says what the holder may do, never who they are. New functionality gets a
new scope rather than widening an existing one, so a token can never quietly gain
access a seller did not approve.

| Scope | What it allows | Yours? |
| - | - | :-: |
| `watches:read` | Read the watches in an inventory | ✅ |
| `watches:write` | Add, update and remove watches | ✅ |
| `orders:read` | Read orders | ✅ |
| `orders:write` | Record that an order has shipped | ✅ |
| `business:write` | Change a business's own details and settings | ❌ |
| `catalogue:read` | Browse the Wristler catalogue | ❌ |
| `messages:read` | Read conversations | ❌ |
| `messages:write` | Reply to conversations | ❌ |
| `uploads:write` | Upload files | ❌ |
| `content:read` | Read the pages, Insights and help centre | ❌ |
| `account:read` | Read somebody's own account, and what they bought | ❌ |
| `account:write` | Change somebody's own account | ❌ |
| `checkout:write` | Place an order and pay for it | ❌ |
| `account-security:write` | Manage a second factor, linked sign-ins and signed-in devices | ❌ |

The ones marked ❌ are ours for now. Asking for one is refused at the token endpoint
with `invalid_scope`: a client-credentials request straight away, and an
authorization code when you exchange it. The consent screen does not check this
yet, so a seller can be shown one and approve it — but no token is ever issued
with it. Ask only for the ✅ ones.

[Why each of them, and which could open up →](https://docs.wristler.eu/partners/capabilities.md)

## Two checks, not one

**1. Does the token carry the scope?**

Your token carries the union of what every business that connected you agreed
to. Without the scope at all, the answer is `403`.

**2. Did this business grant it?**

Checked again per request, against what that business ticked. A shop that
granted you reading answers `403` to a write even when another shop granted you
writing — the token alone cannot answer "may I do this here".

Narrowing or withdrawing a grant takes effect immediately. There is no token to
wait out.

## Asking for fewer

Ask only for what you use. A seller looking at a consent screen reads the list,
and a shorter one is approved more often than a longer one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.