What each API scope grants, and which are restricted.
Every token — team API key or OAuth access token — carries scopes that gate what it can do.
| Scope | Grants |
|---|---|
team:read | Read team information |
team:manage | Update team settings (DAC7 reporting) |
payouts:read | List and read payouts |
payouts:write | Create payouts (kept pending; no approval/execution) |
payouts:approve | Create payouts as pre-approved. Restricted — only granted to admin-provisioned OAuth clients and to API keys for teams with the payout.api_approve permission. Not available via dynamic client registration. |
webhooks:read | List webhook subscriptions |
webhooks:write | Create and delete webhook subscriptions |
sessions:write | Mint hosted session URLs (granted by default) |
For OAuth, include offline_access in the scope list to receive a refresh token.
https://talentir.com/oauth/team_id claim. For platforms this is usually a customer's team, not your own.payouts:write alone can never move money: created payouts stay pending until a team member approves them (see Approve and execute payouts). Money movement always requires either the restricted payouts:approve scope or an explicit human approval backed by the team's passkey wallet and daily allowance.