Scopes
Scopes go on the wire fully qualified, prefixed with https://api.filemark.ca/ — the short name clients:read is sent as https://api.filemark.ca/clients:read.
| Short scope | Grants |
|---|---|
mcp | MCP transport access — request this for any MCP client |
clients:read | List or get clients |
entities:read | List or get legal entities |
tax-years:read | List or get tax years |
engagements:read | Get engagement metadata |
documents:read | List document metadata |
workpapers:read | List workpaper metadata |
review:read | Get review indicators |
tax:compute | List and run deterministic computations |
read | Legacy alias that only lists clients — prefer clients:read |
The authorization server also defines *:write, exports, portal, integrations, and admin scopes for future capabilities; they grant nothing today. The Developer credential form does not offer unpublished mutation or external-effect scopes, and new-client creation rejects broad unallocated reservations, so don't build against them.