generated: '2026-07-31'
method: searched
source: https://developers.cart.com/docs/rest-api/3e66e3e0c67ec-scopes
docs: https://developers.cart.com/docs/rest-api/3e66e3e0c67ec-scopes
note: 'The published OpenAPI declares only the apiKey scheme X-AC-Auth-Token and carries
  no oauth2 securityScheme, so no scopes are derivable from the spec. The scope model
  below is captured verbatim from the provider''s Scopes and Authentication guides.
  Scopes are coarse-grained and paired read/write: naming a write scope supersedes
  its read sibling. An access token can only use the scopes requested when it was created
  — changing scope requires a new token. The authorizing admin-console user must also
  hold the matching role-based permission.'
schemes:
- name: OAuth2
  type: oauth2
  source: https://developers.cart.com/docs/rest-api/ZG9jOjU4NjM4-cart-com-online-store-api-authentication
  flows:
  - flow: authorizationCode
    authorizationUrl: https://[mystorename.com]/api/oauth
    tokenUrl: https://[mystorename.com]/api/oauth/access_token
    refreshUrl: https://[mystorename.com]/api/oauth/refresh_token
    note: 'Non-standard OAuth 2 variant — the token exchange is authenticated with
      a SHA256 signature over secret + code + client_id + scope + redirect_uri rather
      than a client_secret POST parameter. Tokens are returned as access_token + refresh_token
      and presented on the API as the X-AC-Auth-Token header, not as a Bearer token.'
scopes:
- scope: read_people
  description: View customer, user, or profile data.
  group: People
  access: read
  admin_permissions: [Customers, CustomerTypes, UserAccounts, StoreSettings]
  applies_to: [addresses, customers, customer_association, customer_types, customer_payment_methods,
    profiles, users]
- scope: people
  description: View and change customer, user, or profile data; supersedes read_people
    if specified together.
  group: People
  access: write
  admin_permissions: [Customers, CustomerTypes, UserAccounts, StoreSettings]
  applies_to: [addresses, customers, customer_association, customer_types, customer_payment_methods,
    profiles, users]
- scope: read_orders
  description: View order data.
  group: Orders
  access: read
  admin_permissions: [Orders, OrderStatuses]
  applies_to: [carts, cart_items, credit_cards, orders, order_addresses, order_items,
    order_payments, order_shipments, order_statuses, quotes, subscriptions]
- scope: orders
  description: View and change order data; supersedes read_orders if specified together.
  group: Orders
  access: write
  admin_permissions: [Orders, OrderStatuses]
  applies_to: [carts, cart_items, credit_cards, orders, order_addresses, order_items,
    order_payments, order_shipments, order_statuses, quotes, subscriptions]
- scope: read_catalog
  description: View catalog data.
  group: Catalog
  access: read
  admin_permissions: [Products, ProductStatuses, VariationGroups, ProductAttributes,
    Categories, Manufacturers]
  applies_to: [attributes, attribute_groups, categories, manufacturers, products, product_inactive_in_store,
    product_lists, product_pictures, product_statuses, product_variants, shipping_rate_adjustments,
    variant_groups, variant_inventory]
- scope: catalog
  description: View and change catalog data; supersedes read_catalog if specified together.
  group: Catalog
  access: write
  admin_permissions: [Products, ProductStatuses, VariationGroups, ProductAttributes,
    Categories, Manufacturers]
  applies_to: [attributes, attribute_groups, categories, manufacturers, products, product_inactive_in_store,
    product_lists, product_pictures, product_statuses, product_variants, shipping_rate_adjustments,
    variant_groups, variant_inventory]
- scope: read_content
  description: View blog, page, and other content-related data.
  group: Content
  access: read
  admin_permissions: [Blogs, BlogCategories, BlogPosts, ContentManagement, UrlRedirecting]
  applies_to: [blogs, blog_categories, blog_posts, links, pages]
- scope: content
  description: View and change blog, page, and other content-related data; supersedes
    read_content if specified together.
  group: Content
  access: write
  admin_permissions: [Blogs, BlogCategories, BlogPosts, ContentManagement, UrlRedirecting]
  applies_to: [blogs, blog_categories, blog_posts, links, pages]
- scope: read_marketing
  description: View adcode, discount, and other marketing-related data.
  group: Marketing
  access: read
  admin_permissions: [AdCodes, EmailEditor, MailingList, DiscountMethods, GiftCertificates]
  applies_to: [adcodes, coupon_codes, discount_actions, discount_methods, discount_rules,
    drips, email_templates, gift_certificates, gift_certificate_transactions, mailing_lists]
- scope: marketing
  description: View and change adcode, discount, and other marketing-related data;
    supersedes read_marketing if specified together.
  group: Marketing
  access: write
  admin_permissions: [AdCodes, EmailEditor, MailingList, DiscountMethods, GiftCertificates]
  applies_to: [adcodes, coupon_codes, discount_actions, discount_methods, discount_rules,
    drips, email_templates, gift_certificates, gift_certificate_transactions, mailing_lists]
- scope: email
  description: Send email templates.
  group: Specialized
  admin_permissions: [EmailEditor]
  applies_to: ['POST /api/v1/email_templates/{id}/send']
- scope: custom_fields
  description: Read and write custom field definitions and values.
  group: Specialized
  admin_permissions: [CustomFields]
  applies_to: [custom_fields, custom_field_values]
- scope: import
  description: Use the data import resource.
  group: Specialized
  admin_permissions: [DataImport]
  applies_to: [import]
- scope: settings
  description: Read and write store settings — shipping, warehouses, tax, regions,
    payment gateways, redirects.
  group: Specialized
  admin_permissions: [Shipping, Warehouses, TaxRates, GlobalRegions, PaymentGateways,
    UrlRedirecting]
  applies_to: [blacklisted_ips, custom_shipping_methods, external_image_whitelist,
    payment_methods, regions, shipping_providers, shipping_provider_services, store_locations,
    tax_rates, url_redirects, warehouses]
- scope: system
  description: Perform system tasks — stores, microstores, sessions, file upload. Also
    required to manage webhook subscriptions.
  group: Specialized
  admin_permissions: [FileBrowser, Sessions, StoreSettings]
  applies_to: [microstores, stores, sessions, 'POST /api/v1/upload']
- scope: decrypt
  description: Allows sensitive information to be decrypted. The authorizing user must
    have access to view this information. Tokens with this scope must be regenerated
    every 90 days if combined with no_expiry.
  group: Sensitive
  applies_to: ['GET /api/v1/credit_cards/{id}/decrypted', 'GET /api/v1/order_payments/{id}/decrypted']
- scope: no_expiry
  description: Token does not expire and does not require a refresh_token.
  group: Sensitive
x-evidence:
  fetched: '2026-07-31'
  urls:
  - https://developers.cart.com/docs/rest-api/3e66e3e0c67ec-scopes
  - https://developers.cart.com/docs/rest-api/ZG9jOjU4NjM4-cart-com-online-store-api-authentication
  http_status: 200