Understanding scopes Praxis Desk

Scopes are permissions that define which data an API access credential can read or modify. You assign scopes when creating an API access credential, and you can change them later at any time, see Manage API access.

Available scopes

Scope	Label	Description
full_access	Full access	Access to all areas. Includes and replaces all other scopes.
appointments	Appointments	Read appointments and free appointment slots, book and cancel appointments. Reading appointments additionally requires users.
courses	Courses	Read courses and their attendees. Always additionally requires users, and customers for the attendee list.
customers	Customers	Read, create, and edit customers and customer fields
services	Services	Read services and service categories
company	Company	Read the company profile and tenants
locations	Locations	Read locations
users	Users	Read users
executions	Service assignments	Read which user offers which service at which location
medicals	Medical data	Read and create medical patient data — for example diagnoses, findings, regulations, doctor letters, and files. Fee note services can also be edited.
invoices	Invoices	Read invoices, cash revenues, and fee notes
wares	Wares & stock	Read product master data and ware categories. Stock, movements, purchase orders, storages, and distributors additionally only if Stock management is booked
notices	Notes	Read and create customer notes
todos	Todos	Read, create, update, and delete todos
forms	Forms	Read forms and sent forms, metadata only. Answers from completed forms and recipient data are never included.
dunnings	Dunning	Read and create dunning notices
reports	Reports	Read turnover and productivity reports

Note: Offisy Connect uses its own connect scope. You cannot assign this scope yourself — it is set automatically when a device is connected.

Recommendation

Always grant only the permissions an application actually needs. If an application only reads appointments, the appointments and users scopes are enough — full access is not necessary.

This principle of least privilege protects your data: if an API access credential ends up in the wrong hands, the potential damage is limited.

You can find the full technical reference of all scopes in the API reference.