Scopes

Configure permissions for your API keys.

When using the Ploi API you will need to configure the scopes (permissions) for your API key. Ploi makes this easy through the UI.

Each endpoint requires its own scopes. For example, if you only want to interact with cronjobs, you should only allow the cronjob scopes.

This allows much more customization per API token and protects routes that should not be triggered easily or by accident. For example, you can avoid disaster by excluding the site deletion and server deletion scope so nothing gets removed accidentally.

Creating and deleting are separate scopes: a key that can create firewall rules cannot delete them unless it also has Delete network rules. Scopes are fixed once a key is created, so to add one you create a new API key. A request without the required scope returns a 403 that names the missing scope.