Core

Key permissions

API keys and MCP connections are read-only by default, and can be limited to the categories they need.

Read and write

Every endpoint is labelled read or write (see access in get_scraper_schema, x-apizie-access in the OpenAPI spec and the “write” tag in the catalog). Apizie's official sources only read. Bring-your-own-key endpoints that create, change or delete something at a provider are write.

Key access	What it can call
`read` (default for new keys)	Every read endpoint. Write endpoints answer `403 key_read_only` and are not billed.
`read_write`	Everything, including write endpoints on your own provider accounts.

Keys created before permissions existed keep full access. The dashboard shows when a key last wrote anything and offers to make keys that never write read-only.

Category limits

Limit a key to categories such as official or finance. Calls elsewhere answer 403 key_scope, and MCP search only lists what the key may use.

curl -X POST "https://apizie.tech/api/me/keys" -H "cookie: …" -H "x-zie-csrf: 1" \
  -H "content-type: application/json" \
  -d '{"name":"research-agent","access":"read","categories":["official","finance"]}'

MCP connections

When Claude or ChatGPT connects with OAuth, the consent screen asks for read-only or read and write, and which categories. Change it later in Dashboard → API keys.

Watching for refusals

Refused calls appear in your logs (filter “Blocked”) and send a key.blocked webhook.