sendly-now OAuth Scopes

generated: '2026-10-31'
method: derived
source: openapi/openapi.json, openapi/sendly-now-openapi.json
schemes:
- name: OAuth2
  source: openapi/openapi.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.sendly.now/api/auth/oauth2/authorize
    tokenUrl: https://app.sendly.now/api/auth/oauth2/token
  description: |-
    OAuth 2.1 with PKCE, for AI agents and other delegated clients (this is what the MCP endpoint at `/api/mcp` uses, and how a third-party application sends on a user's behalf). Tokens are minted through the consent screen and carry ONLY the scopes the user ticked there, so an operation lists the single scope it requires and a token without it answers `403` with code `SCOPE_MISSING` — before any input is parsed. Unlike an API key, a delegated token reaches an operation only where the route itself declares a scope; every other route refuses it outright.

    **Ask for the right audience.** Pass `resource=https://app.sendly.now/api` on the authorization AND the token request to receive a token for this REST API; `resource=https://app.sendly.now/api/mcp` is the MCP endpoint's identifier. A request carrying no `resource` receives an OPAQUE token, which every endpoint here rejects. Each identifier publishes RFC 9728 metadata at `/.well-known/oauth-protected-resource/api` and `/.well-known/oauth-protected-resource/api/mcp`.

    **Name the project on every call.** An OAuth grant belongs to a USER, not to a project — the same person may belong to several — so a delegated token carries no tenant and the project is chosen per request with the `x-project-id` header, checked against real membership. Omit it and a project-scoped operation answers `400`; send one the user does not belong to and it answers `403 PROJECT_ACCESS_DENIED`. List the projects a token may name with `GET /api/users/me/projects` (scope `projects:read`), which needs no header. API keys are unaffected: a key already names its project.
- name: OAuth2
  source: openapi/sendly-now-openapi.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.sendly.now/api/auth/oauth2/authorize
    tokenUrl: https://app.sendly.now/api/auth/oauth2/token
  description: |-
    OAuth 2.1 with PKCE, for AI agents and other delegated clients (this is what the MCP endpoint at `/api/mcp` uses, and how a third-party application sends on a user's behalf). Tokens are minted through the consent screen and carry ONLY the scopes the user ticked there, so an operation lists the single scope it requires and a token without it answers `403` with code `SCOPE_MISSING` — before any input is parsed. Unlike an API key, a delegated token reaches an operation only where the route itself declares a scope; every other route refuses it outright.

    **Ask for the right audience.** Pass `resource=https://app.sendly.now/api` on the authorization AND the token request to receive a token for this REST API; `resource=https://app.sendly.now/api/mcp` is the MCP endpoint's identifier. A request carrying no `resource` receives an OPAQUE token, which every endpoint here rejects. Each identifier publishes RFC 9728 metadata at `/.well-known/oauth-protected-resource/api` and `/.well-known/oauth-protected-resource/api/mcp`.

    **Name the project on every call.** An OAuth grant belongs to a USER, not to a project — the same person may belong to several — so a delegated token carries no tenant and the project is chosen per request with the `x-project-id` header, checked against real membership. Omit it and a project-scoped operation answers `400`; send one the user does not belong to and it answers `403 PROJECT_ACCESS_DENIED`. List the projects a token may name with `GET /api/users/me/projects` (scope `projects:read`), which needs no header. API keys are unaffected: a key already names its project.
scopes:
- scope: account:read
  description: See your profile and notification preferences
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: account:write
  description: Edit your profile and preferences, export your data, delete your account
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: analytics:read
  description: View your sending analytics and engagement metrics
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: api-keys:read
  description: See which API keys exist, including what each one is allowed to do
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: api-keys:write
  description: Create, rotate, and revoke API keys — these keep working even after you disconnect
    this app
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: billing:read
  description: See your plan, usage, invoices and spending limits
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: billing:write
  description: Start a checkout, change spending limits, open the billing portal, cancel or
    refund
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: campaigns:read
  description: View your campaigns and their performance
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: campaigns:send
  description: Send or schedule your campaigns to their audience
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: campaigns:write
  description: Create, edit, and organize your campaigns
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: connections:read
  description: See connected services such as Slack and connected AI apps
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: connections:write
  description: Connect, re-verify and disconnect services
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: contacts:read
  description: View your contacts and their custom fields
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: contacts:write
  description: Create, update, and delete your contacts
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: deliverability:read
  description: Check why mail from one of your domains is not arriving
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: domains:read
  description: View your sending domains and their verification status
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: domains:write
  description: Add and remove sending domains, and trigger verification
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: emails:read
  description: View the emails you have sent and their delivery status
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: emails:send
  description: Send emails from your verified domains
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: emails:test
  description: Send test emails to your own address from the Sendly sandbox
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: events:read
  description: View the custom events your application has recorded
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: events:write
  description: Record custom events for your contacts
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: lists:read
  description: View your subscriber lists and who is on them
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: lists:write
  description: Create, rename, and delete your subscriber lists
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: mailbox-conversations:read
  description: Read the conversations in your hosted mailboxes — every message and attachment
    people have sent you
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: mailbox-conversations:reply
  description: Reply to conversations in your hosted mailboxes, from the mailbox's own address
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: mailboxes:read
  description: View the mailboxes on your domains and their settings
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: mailboxes:send
  description: Write and send new email from your hosted mailboxes, as that address
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: mailboxes:write
  description: Create and delete mailboxes on your verified domains
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: members:read
  description: See who belongs to your projects
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: members:write
  description: Add and remove project members and change their roles
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: projects:read
  description: View your projects and their settings
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: projects:write
  description: Create, change, reset and delete projects on your account
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: segments:read
  description: View your segments and who belongs to them
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: segments:write
  description: Create, edit, and delete your segments
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: support:read
  description: See your support tickets
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: support:write
  description: Open support tickets and suspension appeals
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: suppression:read
  description: View the addresses on your suppression list
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: suppression:write
  description: Add and remove addresses on your suppression list
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: templates:read
  description: View your email templates
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: templates:write
  description: Create, edit, and delete your email templates
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: topics:read
  description: View the topics you mail about and who is subscribed to each
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: topics:write
  description: Create and edit topics, and change what your contacts are subscribed to — this
    decides who your campaigns reach
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: usage:read
  description: View your usage totals and billing limits
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: validation:read
  description: View your email validation runs and their results
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: validation:write
  description: Check whether email addresses can receive mail — this is billed per address
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: webhooks:read
  description: View your webhook endpoints and their delivery history
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: webhooks:write
  description: Create, edit, and delete your webhook endpoints
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: workflows:read
  description: View your automation workflows and their runs
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json
- scope: workflows:write
  description: Create, edit, enable, and delete your automation workflows
  flows:
  - authorizationCode
  sources:
  - openapi/openapi.json
  - openapi/sendly-now-openapi.json