Vacation TrackerDeveloper Docs
REST API v2

Scopes by endpoint

Which scopes each API v2 endpoint requires, and the scopes that depend on the request.

Every endpoint and the scopes it needs, generated from the OpenAPI spec. A request without them answers 403 INSUFFICIENT_SCOPE, with the missing scopes in details.requiredScopes.

A :write scope implies its :read scope, so a key that holds leaves:write does not need leaves:read as well. See Scopes for what each one covers, and the role ceiling for which of them a key owner can grant.

Scopes that depend on the request

These are not endpoint scopes: they apply only when a request asks for the data behind them, on top of whatever the endpoint itself requires.

ConditionAlso requires
expand=user or expand=approver on a leaveusers:read
expand=leaveType on a leaveleave-types:read
expand=location on a userlocations:read
expand=department on a userdepartments:read
expand=holidays on a userholidays:read
Reading reason or statusReason on a leave or TOIL requestleaves:read-reason
Reading the name of a hidden leave typeleave-types:read-hidden
Sending X-On-Behalf-Ofusers:act-on-behalf

departments

EndpointWhat it doesScopes
GET /v2/departmentsList departmentsdepartments:read
POST /v2/departmentsCreate a departmentdepartments:write
GET /v2/departments/{id}Get a departmentdepartments:read
PATCH /v2/departments/{id}Update a departmentdepartments:write
DELETE /v2/departments/{id}Delete a departmentdepartments:write

locations

EndpointWhat it doesScopes
GET /v2/locationsList locationslocations:read
POST /v2/locationsCreate a locationlocations:write
GET /v2/locations/{id}Get a locationlocations:read
PATCH /v2/locations/{id}Update a locationlocations:write
DELETE /v2/locations/{id}Delete a locationlocations:write
GET /v2/locations/{id}/work-weekGet a location's work weeklocations:read
PUT /v2/locations/{id}/work-weekReplace a location's work weeklocations:write
GET /v2/locations/{id}/holidaysList a location's holidaysholidays:read
POST /v2/locations/{id}/holidaysCreate a holidayholidays:write
GET /v2/locations/{id}/holidays/{holidayId}Get a holidayholidays:read
PATCH /v2/locations/{id}/holidays/{holidayId}Update a holidayholidays:write
DELETE /v2/locations/{id}/holidays/{holidayId}Delete a holidayholidays:write
GET /v2/locations/{id}/leave-policiesList a location's leave policiesleave-policies:read
GET /v2/locations/{id}/leave-policies/{leaveTypeId}Get a location's leave policy for a leave typeleave-policies:read
PUT /v2/locations/{id}/leave-policies/{leaveTypeId}Enable or replace a location's leave policy for a leave typeleave-policies:write
PATCH /v2/locations/{id}/leave-policies/{leaveTypeId}Change a location's leave policy for a leave typeleave-policies:write
DELETE /v2/locations/{id}/leave-policies/{leaveTypeId}Disable a location's leave policy for a leave typeleave-policies:write

labels

EndpointWhat it doesScopes
GET /v2/labelsList labelslabels:read
POST /v2/labelsCreate a labellabels:write
GET /v2/labels/{id}Get a labellabels:read
PATCH /v2/labels/{id}Update a labellabels:write
DELETE /v2/labels/{id}Delete a labellabels:write

leave-types

EndpointWhat it doesScopes
GET /v2/leave-typesList leave typesleave-types:read
POST /v2/leave-typesCreate a leave typeleave-types:write
GET /v2/leave-types/{id}Get a leave typeleave-types:read
PATCH /v2/leave-types/{id}Update a leave typeleave-types:write
DELETE /v2/leave-types/{id}Delete a leave typeleave-types:write

leaves

EndpointWhat it doesScopes
GET /v2/leavesList leaves between two datesleaves:read
POST /v2/leavesCreate a leaveleaves:write
GET /v2/leaves/{id}Get a leaveleaves:read
PATCH /v2/leaves/{id}Update a leaveleaves:write
DELETE /v2/leaves/{id}Delete a leaveleaves:write
POST /v2/leaves/{id}/approveApprove a leaveleaves:approve
POST /v2/leaves/{id}/denyDeny a leaveleaves:approve
POST /v2/leaves/{id}/cancelCancel a leaveleaves:write

toil

EndpointWhat it doesScopes
GET /v2/toilList TOIL requests between two datestoil:read
POST /v2/toilCreate a TOIL requesttoil:write
GET /v2/toil/{id}Get a TOIL requesttoil:read
PATCH /v2/toil/{id}Update a TOIL requesttoil:write
DELETE /v2/toil/{id}Delete a TOIL requesttoil:write
POST /v2/toil/{id}/approveApprove a TOIL requestleaves:approve
POST /v2/toil/{id}/denyDeny a TOIL requestleaves:approve
POST /v2/toil/{id}/cancelCancel a TOIL requesttoil:write

users

EndpointWhat it doesScopes
GET /v2/usersList usersusers:read
GET /v2/users/{id}Get a userusers:read
PATCH /v2/users/{id}Update a user's profileusers:write
GET /v2/users/{id}/balancesGet a user's leave balancesbalances:read
GET /v2/users/{id}/labelsList a user's labelslabels:read
POST /v2/users/{id}/labelsAssign a label to a userlabels:write
DELETE /v2/users/{id}/labels/{labelId}Remove a label from a userlabels:write
PUT /v2/users/{id}/locationMove a user to another locationusers:write
PUT /v2/users/{id}/departmentMove a user to another departmentusers:write
POST /v2/users/{id}/activateActivate a userusers:write
POST /v2/users/{id}/deactivateDeactivate a userusers:write
PUT /v2/users/{id}/location-adminMake a user a Location Adminusers:write
DELETE /v2/users/{id}/location-adminRemove a user's Location Admin roleusers:write
PUT /v2/users/{id}/work-weekSet a user's custom work weekusers:write
DELETE /v2/users/{id}/work-weekReset a user's work weekusers:write
GET /v2/users/{id}/quotasGet a user's leave quotasusers:read
PUT /v2/users/{id}/quotas/{leaveTypeId}Set a user's quota for a leave typeusers:write

automations

EndpointWhat it doesScopes
GET /v2/automations/{type}List automations of a typeautomations:read
POST /v2/automations/{type}Create an automationautomations:write
GET /v2/automations/{type}/{id}Get an automationautomations:read
PATCH /v2/automations/{type}/{id}Update an automationautomations:write
DELETE /v2/automations/{type}/{id}Delete an automationautomations:write

notifications

EndpointWhat it doesScopes
GET /v2/notificationsList notificationsnotifications:read
POST /v2/notificationsCreate a notificationnotifications:write
GET /v2/notifications/{id}Get a notificationnotifications:read
PATCH /v2/notifications/{id}Update a notificationnotifications:write
DELETE /v2/notifications/{id}Delete a notificationnotifications:write

scheduled-reports

EndpointWhat it doesScopes
GET /v2/scheduled-reportsList scheduled reportsnotifications:read
POST /v2/scheduled-reportsCreate a scheduled reportnotifications:write
GET /v2/scheduled-reports/{id}Get a scheduled reportnotifications:read
PATCH /v2/scheduled-reports/{id}Update a scheduled reportnotifications:write
DELETE /v2/scheduled-reports/{id}Delete a scheduled reportnotifications:write

operations

EndpointWhat it doesScopes
GET /v2/operations/{id}Get an operationAny valid key

webhooks

EndpointWhat it doesScopes
GET /v2/webhooksList webhookswebhooks:read
POST /v2/webhooksCreate a webhookwebhooks:write
GET /v2/webhooks/{id}Get a webhookwebhooks:read
PATCH /v2/webhooks/{id}Update a webhookwebhooks:write
DELETE /v2/webhooks/{id}Delete a webhookwebhooks:write
POST /v2/webhooks/{id}/testSend a test eventwebhooks:write
POST /v2/webhooks/{id}/rotate-secretRotate the signing secretwebhooks:write
POST /v2/webhooks/{id}/pausePause a webhookwebhooks:write
POST /v2/webhooks/{id}/resumeResume a webhookwebhooks:write

Authentication and API keys

Create scoped v2 API keys, and learn how the role ceiling, expiry, rotation and revocation work.

Acting on behalf of users

Send v2 requests as another user with the X-On-Behalf-Of header.

On this page

Scopes that depend on the requestdepartmentslocationslabelsleave-typesleavestoilusersautomationsnotificationsscheduled-reportsoperationswebhooks

Need help?

developers@vacationtracker.io