Scopes

A scope says what a token may do. API tokens and OAuth apps use the same scopes: you tick them when you create a token, and an app asks for them when it sends someone to InfraNest to connect.

Each area has a read scope and, where the API takes changes, a write scope. Write includes read. Whatever the scopes, a token never does what only a person signed in to the app may do. See What a token can never do.

Scope	Area	What it allows
domains.read	Domains & Contacts	Read domains, contacts and registrar details.
domains.write	Domains & Contacts	Track a domain, edit its notes and labels, archive it, and manage the contact book. Includes read.
dns.read	DNS	Read DNS zones and records.
dns.write	DNS	Create, change and delete records, undo a change, apply a template and sync a zone. Includes read.
cloud.read	Cloud Infrastructure	Read servers, volumes, networks, firewalls and load balancers.
cloud.write	Cloud Infrastructure	Change InfraNest's own server records: labels, pricing, snooze and alert rules. Includes read.
monitoring.read	Monitoring	Read monitors and their results, incidents, maintenance windows, status pages and certificates.
monitoring.write	Monitoring	Change monitors, incidents, maintenance windows, status page content, tags, custom fields and cost items. Includes read.
drop-catch.read	Drop Catch	Read watched domains.
drop-catch.write	Drop Catch	Nothing beyond read: watched domains are changed in the app.
members.read	Members & Teams	Read members and roles.
members.write	Members & Teams	Nothing beyond read: members and roles are changed in the app.
data.read	Data export & import	Export your data.
data.write	Data export & import	Nothing beyond export: importing is done in the app.
billing.read	Billing	Read the subscription and invoices. There is no write scope: billing changes are made in the app.
audit-log.read	Audit Log	Read the organization's audit log. There is no write scope.
*	Everything	Every scope above, read and write. Still never what only a person signed in to the app may do.
mcp:use	AI assistants	Use the InfraNest MCP server. Grants nothing by itself: the other scopes decide what the assistant can read. OAuth only.

An app that asks for mcp:use and nothing else is asked for every read scope, because the MCP server only reads. The person connecting it still sees each scope, and gets only what their role allows.

Every endpoint in the API reference shows the scope it needs. A request without it answers scope_missing, naming the scope in required.