Scopes
Scopes decide which parts of the API your app can reach. Request only the ones your integration needs: people see the list on the consent screen before they approve.
All scopes
The default scope is reports.
- money_in
- Manage invoices and receivables
- money_out
- Manage bills and payables
- banking
- Manage bank connections and transactions
- accounting
- Manage chart of accounts
- journal_entries
- Create and manage journal entries
- transfers
- Create account transfers
- taxes
- Manage tax settings
- close_books
- Lock periods and close books
- reports
- View financial reports
- app_connections
- Manage app connections
- settings
- Manage company settings
- team
- Manage team members and roles
- payroll_view
- View payroll data
- employee_directory
- View the employee directory
- payroll_manage
- Manage payroll runs
- documents
- Manage documents
- time_tracking_view
- View time entries
- time_tracking_manage
- Manage time entries
- time_tracking_approve
- Approve time entries
Requesting scopes
Send them space-separated in the scope parameter of the authorization URL, which is + once URL-encoded:
scope=money_in+money_out+reportsNames Imprest doesn't define are dropped rather than refused, so check the scope field of the token response to see what was granted.
What a scope can't do
A token can never do more than the person who connected it. Each request is checked against the token's scopes and then against that person's role at the company, so a broad scope held by a view-only member still only views.
A token also reaches one company only: the one chosen on the consent screen. See Authentication.