Scopes - Symbiosis

Three scopes exist: read, trade, and withdraw.

Sessions (bearer tokens from POST /auth/login) carry all three.
API keys carry exactly the scopes named at mint time, capped at the minting credential’s own scopes. A key never gains scopes later; mint a new key.
Websocket tickets minted from a session carry read only; tickets minted with an HMAC-signed request (POST /auth/ws-ticket/signed) inherit the key’s scopes.

A request with a valid credential but a missing scope returns 403.

Endpoint requirements

Endpoints	Scope
`GET /custody/*` (addresses, balances, withdrawals, ledger)	`read`
`POST /custody/create-deposit-address`	`read`
`POST /custody/withdraw`	`withdraw`
`GET /rfq/*` (requests, quotes, matches)	`read`
`POST /rfq/request`, `DELETE /rfq/request`, `POST /rfq/quote`, `POST /rfq/accept`	`trade`
`POST /auth/ws-ticket/signed`	Any API key (ticket inherits its scopes)
Account management (API keys, password, TOTP, sessions, audit log)	Session only; API keys cannot manage the account that owns them

Recommended key layout

Mint separate keys per concern, so a leaked trading key cannot move funds:

Key	Scopes
Market data / reconciliation	`read`
Trading	`read`, `trade`
Treasury	`read`, `withdraw`