> ## Documentation Index
> Fetch the complete documentation index at: https://docs.symbiosis.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes

> What each credential can do, endpoint by endpoint

Three scopes exist: `read`, `trade`, and `withdraw`.

* **Sessions** (bearer tokens from `POST /auth/login`) carry all three.
* **API keys** carry exactly the scopes named at mint time, capped at the minting
  credential's own scopes. A key never gains scopes later; mint a new key.
* **Websocket tickets** minted from a session carry `read` only; tickets minted with
  an HMAC-signed request (`POST /auth/ws-ticket/signed`) inherit the key's scopes.

A request with a valid credential but a missing scope returns `403`.

## Endpoint requirements

| Endpoints                                                                         | Scope                                                           |
| --------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| `GET /custody/*` (addresses, balances, withdrawals, ledger)                       | `read`                                                          |
| `POST /custody/create-deposit-address`                                            | `read`                                                          |
| `POST /custody/withdraw`                                                          | `withdraw`                                                      |
| `GET /rfq/*` (requests, quotes, matches)                                          | `read`                                                          |
| `POST /rfq/request`, `DELETE /rfq/request`, `POST /rfq/quote`, `POST /rfq/accept` | `trade`                                                         |
| `POST /auth/ws-ticket/signed`                                                     | Any API key (ticket inherits its scopes)                        |
| Account management (API keys, password, TOTP, sessions, audit log)                | Session only; API keys cannot manage the account that owns them |

## Recommended key layout

Mint separate keys per concern, so a leaked trading key cannot move funds:

| Key                          | Scopes             |
| ---------------------------- | ------------------ |
| Market data / reconciliation | `read`             |
| Trading                      | `read`, `trade`    |
| Treasury                     | `read`, `withdraw` |