Scopes
Every API key is granted a specific set of scopes at creation time — one per capability, never a blanket
"full access" grant. A request against an endpoint the key doesn't have the scope for fails with
403 SCOPE_REQUIRED.
Why narrow scopes matter
If a key used only for DNS lookups leaks, granting it dns.read alone limits the blast radius to
DNS lookups — it can't run port scans or generate passwords on your behalf. Grant only what each integration
actually calls.
All scopes
| Scope | Grants access to |
|---|---|
| asn.read | ASN Lookup |
| bgp.read | BGP Route |
| blacklist.read | Blacklist Checker |
| certchain.read | Certificate Chain |
| certconvert.run | Certificate Conversion |
| dns.read | DNS Lookup, DNS Propagation, Reverse DNS |
| headers.read | HTTP Header Analyzer |
| ipcalc.run | IP Calculator |
| iprange.run | IP Range Scan |
| monitoring.read | List Domains, Get Domain, Domain History, Domain Health Score, List Subdomains, List Incidents, List Assistant Analyses, Get Assistant Analysis |
| password.generate | Password Generator |
| ping.run | Ping |
| portscan.run | Port Scanner |
| redirects.read | Redirect Checker |
| ssl.read | SSL Checker |
| tcp.run | TCP Check |
| tls.read | TLS Version |
| traceroute.run | Traceroute |
| udp.run | UDP Check |
| whois.read | WHOIS Lookup |
Checking a key's scopes
Every key's scopes are visible in the Developer Portal table. Scopes can't be edited after creation — if a key needs a different set, create a new one with the right scopes and revoke the old key once traffic has moved over.