OAuth Scopes
Scopes define what permissions your application is requesting from the user. Request only the scopes your application needs.
Available Scopes
| Scope | Description | Recommended |
|---|---|---|
offline_access |
Grants a refresh token for offline access | ✅ Yes |
payment_intent.inbound:read |
Read access to inbound payment intents (invoices) | As needed |
payment_intent.inbound:write |
Write access to inbound payment intents (invoices) | As needed |
payment_intent.outbound:read |
Read access to outbound payment intents (bills) | As needed |
payment_intent.outbound:write |
Write access to outbound payment intents (bills) | As needed |
contacts:read |
Read access to contacts | As needed |
contacts:write |
Write access to contacts | As needed |
transactions:read |
Read access to transaction history. Required alongside the payment intent scopes for every payment intent endpoint except list | As needed |
wallets:read |
Read access to the company's wallets (name, last four digits and whether the wallet is primary) | As needed |
company:read |
Read access to non-sensitive company info | As needed |
accounts:read |
Read Corex accounts, transactions, customer and account contact information, payment networks, and deposit statements | Required for Corex |
Every Corex endpoint requires accounts:read, including transactions and customer details. The Foundation transactions:read, contacts:read, and company:read scopes do not replace it. Ask Truss to enable Corex and approve accounts:read for your application before requesting it through OAuth.
Scopes by Endpoint
A request must carry every scope listed for its endpoint. Inbound and outbound scopes are separate: a token with only inbound scopes cannot call outbound endpoints, and the reverse.
| Endpoint | Required scopes |
|---|---|
GET /v1/company/ |
company:read |
GET /v1/contacts/, GET /v1/contacts/{uid}/ |
contacts:read |
PATCH /v1/contacts/{uid}/ |
contacts:write |
GET /v1/wallets/ |
wallets:read |
GET /v1/payment-intents/inbound/ |
payment_intent.inbound:read |
GET /v1/payment-intents/inbound/{uid}/ |
payment_intent.inbound:read transactions:read |
POST /v1/payment-intents/inbound/, PATCH /v1/payment-intents/inbound/{uid}/, POST /v1/payment-intents/inbound/{uid}/cancel/ |
payment_intent.inbound:write transactions:read |
GET /v1/payment-intents/outbound/ |
payment_intent.outbound:read |
GET /v1/payment-intents/outbound/{uid}/ |
payment_intent.outbound:read transactions:read |
POST /v1/payment-intents/outbound/, PATCH /v1/payment-intents/outbound/{uid}/, POST /v1/payment-intents/outbound/{uid}/cancel/ |
payment_intent.outbound:write transactions:read |
wallets:read is only needed to list wallets. Choosing a wallet with wallet_uid on create does not require wallets:read, but still requires the payment intent write scope and transactions:read (see the create rows in the table above).
Requests without a required scope return 403.
