> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dueflow.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes and roles

> Every scope, what it grants, and the role required to hold it.

A token's effective permissions are its granted scopes intersected with the
ceiling of the role it acts under. Asking for a scope your role can't hold is
rejected at creation time rather than silently dropped.

## Scopes

| Scope                    | Grants                                                                                  | Minimum role |
| ------------------------ | --------------------------------------------------------------------------------------- | ------------ |
| `organization:read`      | Read the organization's profile and public settings.                                    | viewer       |
| `chapters:read`          | Read the child chapters of a national organization, including their member rosters.     | viewer       |
| `members:read`           | Read the member roster. Excludes phone numbers, guardian and emergency contact details. | viewer       |
| `members:write`          | Create, update and archive members.                                                     | editor       |
| `groups:read`            | Read member groups and their membership.                                                | viewer       |
| `groups:write`           | Create, update and delete member groups.                                                | editor       |
| `payments:read`          | Read dues charges, their status and payment history.                                    | viewer       |
| `reimbursements:read`    | Read reimbursement requests and their status.                                           | viewer       |
| `reimbursements:approve` | Approve, reject and mark reimbursements as paid.                                        | admin        |
| `payouts:read`           | Read withdrawals from the organization's balance.                                       | editor       |
| `reminders:read`         | Read scheduled and sent payment reminders.                                              | viewer       |
| `reminders:send`         | Send email and SMS payment reminders. These cost money and are rate limited.            | editor       |
| `fundraise:read`         | Read campaigns and donations. Excludes donors' names, emails and phone numbers.         | viewer       |
| `store:read`             | Read store listings and orders. Excludes guest buyers' contact details.                 | viewer       |
| `audit:read`             | Read the organization's activity log.                                                   | admin        |

## Role ceilings

| Role   | Can hold                                                                                                                                                                                                                                                                 |
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| viewer | `organization:read`, `chapters:read`, `members:read`, `groups:read`, `payments:read`, `reimbursements:read`, `reminders:read`, `fundraise:read`, `store:read`                                                                                                            |
| editor | `organization:read`, `chapters:read`, `members:read`, `members:write`, `groups:read`, `groups:write`, `payments:read`, `reimbursements:read`, `payouts:read`, `reminders:read`, `reminders:send`, `fundraise:read`, `store:read`                                         |
| admin  | `organization:read`, `chapters:read`, `members:read`, `members:write`, `groups:read`, `groups:write`, `payments:read`, `reimbursements:read`, `reimbursements:approve`, `payouts:read`, `reminders:read`, `reminders:send`, `fundraise:read`, `store:read`, `audit:read` |