Scopes

Scopes control which API areas an OAuth client is allowed to access. You assign scopes when creating an API access in the Offisy settings.

Setting up API access is described in the Help Center.

Available scopes

Scope	Label	Description	Unlocked endpoints
full_access	Full access	Access to all endpoints	All
appointments	Appointments	Retrieve and book appointments. GET /appointments and GET /appointments/{uuid} always require users in addition. For course appointments additionally customers. The course endpoints themselves require the courses and users scopes.	GET /appointments, GET /appointments/{uuid}, GET /appointments/{uuid}/references, GET /booking/available-slots, GET /booking/available-slots/batch, GET /booking/available-slots/next, POST /appointments/service, POST /appointments/{uuid}/cancel
courses	Courses	Retrieve courses. Always additionally requires users. For the attendee list (attendees) the scope customers is additionally required. Without customers, the attendees key is missing from the response entirely — it is not [] and not null. The number currentAttendees is always included. The attendee endpoints always require the scopes courses, users, and customers. All course endpoints additionally require the course license; without it they respond with 403.	GET /courses, GET /courses/{uuid}, GET /courses/{uuid}/attendees, GET /courses/{uuid}/attendees/{attendeeUuid}
customers	Customers	Retrieve, create, and update customers	GET /customers, GET /customers/{uuid}, GET /customers/last-opened, POST /customers, PUT /customers/{uuid}, GET /customers/values, GET /customers/values/{uuid}, POST /customers/values, GET /customers/groups, GET /customers/groups/{uuid}, POST /customers/groups, PUT /customers/groups/{uuid}, DELETE /customers/groups/{uuid}, GET /customers/{uuid}/groups, POST /customers/{uuid}/groups/{groupUuid}, DELETE /customers/{uuid}/groups/{groupUuid}
notices	Notes	Read and create customer notes	GET /customers/notices, GET /customers/notices/{uuid}, POST /customers/notices
todos	Todos	Read, create, update, and delete todos. customerUuid always additionally requires customers, assignedToUuid additionally requires users	GET /todos, GET /todos/{uuid}, POST /todos, PUT /todos/{uuid}, DELETE /todos/{uuid}, GET /todos/statuses, GET /todos/statuses/{uuid}, GET /todos/tags, GET /todos/tags/{uuid}, POST /todos/{uuid}/status, GET /todos/{uuid}/references, POST /todos/{uuid}/references, GET /todos/{uuid}/references/{referenceUuid}, DELETE /todos/{uuid}/references/{referenceUuid}
forms	Forms	Access to forms and sent forms, metadata only (no form answers, no recipient data)	GET /forms/{uuid}, GET /forms/customers/{uuid}
services	Services	Retrieve services	GET /services, GET /services/{uuid}, GET /services/categories, GET /services/categories/{uuid}
company	Company	Retrieve company profile and tenants	GET /company, GET /tenancies, GET /tenancies/{uuid}
locations	Locations	Retrieve locations	GET /locations, GET /locations/{uuid}
users	Users	Retrieve users	GET /users, GET /users/{uuid}
executions	Service assignments	Retrieve service assignments — which users offer which service at which location	GET /executions
medicals	Medical data	Read and create medical patient data	Fee note services: GET /fee-note-services, GET /fee-note-services/{uuid}, POST /fee-note-services, PUT /fee-note-services/{uuid}; Diagnoses: GET /diagnoses, GET /diagnoses/{uuid}, POST /diagnoses; Evidences: GET /evidences, GET /evidences/{uuid}, POST /evidences; Long-term medications: GET /long-term-medications, GET /long-term-medications/{uuid}, POST /long-term-medications; Sports exemptions: GET /sports-exemptions, GET /sports-exemptions/{uuid}, POST /sports-exemptions; Referrals: GET /referrals, GET /referrals/{uuid}, POST /referrals; Incoming referrals: GET /incoming-referrals, GET /incoming-referrals/{uuid}, POST /incoming-referrals; Regulations: GET /regulations, GET /regulations/{uuid}, POST /regulations; Visit confirmations: GET /visit-confirmations, GET /visit-confirmations/{uuid}, POST /visit-confirmations; Doctor letters: GET /doctor-letters, GET /doctor-letters/{uuid}, POST /doctor-letters; Patient letters: GET /patient-letters, GET /patient-letters/{uuid}, POST /patient-letters; Transports: GET /transports, GET /transports/{uuid}, POST /transports; Lab results: GET /lab-results, GET /lab-results/{uuid}, POST /lab-results; Illness notifications: GET /illness-notifications, GET /illness-notifications/{uuid}, POST /illness-notifications; Health notifications: GET /health-notifications, GET /health-notifications/{uuid}, POST /health-notifications; Files: GET /files, GET /files/{uuid}, GET /files/{uuid}/download, POST /files
dunnings	Dunning	Retrieve and create dunning notices, retrieve dunning levels	GET /invoices/dunnings, GET /invoices/dunnings/{uuid}, POST /invoices/dunnings, GET /invoices/dunnings/types, GET /invoices/dunnings/types/{uuid}
invoices	Invoices	Retrieve invoices, cash revenues, and fee notes	GET /invoices, GET /invoices/{uuid}, GET /cash-revenues, GET /cash-revenues/{uuid}, GET /fee-notes, GET /fee-notes/{uuid}
wares	Wares & stock	Retrieve product master data (GET /wares, GET /wares/{uuid}) and ware categories (GET /wares/categories) — the permission alone is enough. Stock, movements, purchase orders, storages, and distributors additionally require Stock management. Without it, GET /wares still returns 200 but without the stock block; the other affected endpoints return 403.	GET /wares, GET /wares/{uuid}, GET /wares/movements, GET /wares/movements/{uuid}, GET /wares/purchases, GET /wares/purchases/{uuid}, GET /wares/categories, GET /wares/categories/{uuid}, GET /wares/storages, GET /wares/storages/{uuid}, GET /wares/distributors, GET /wares/distributors/{uuid}
reports	Reports	Retrieve turnover and productivity reports. Grouping by customer (groupBy=customer, customerId) additionally requires customers.	GET /fee-note-services/turnover, GET /fee-note-services/productivity

Note: A client with the full_access scope passes every scope check automatically — regardless of which scope is required at a given endpoint.