Each key has one or more scopes, chosen when you create it. A request to an endpoint the key’s scopes don’t cover gets 403 Forbidden. GET /whoami works with any valid key: use it to check a key and see its scopes.

​
A key acts for the person who created it

Scopes narrow what a key may call; the key’s creator’s own permissions still apply. A key can never do more than the person who made it can: if they can’t edit an event, the key can’t either, and if they leave your organisation, their keys stop working. Changes made with a key are recorded in your audit log against its creator, marked with the key. To change a key’s scopes, create a new key with the scopes you need and revoke the old one.