API keys are scoped. Every key carriesDocumentation Index
Fetch the complete documentation index at: https://docs.arcmira.com/llms.txt
Use this file to discover all available pages before exploring further.
read plus any of the explicit write scopes you grant. Endpoints that require a scope you don’t have return 403 insufficient_scope with a clear message.
The scopes
| Scope | Tier required | Required for |
|---|---|---|
read | Any | All read endpoints (search, entities, mentions, appearances). Granted automatically on every key. |
watchlists:write | Any paid | POST /v1/watchlists, PATCH /v1/watchlists/{id}, DELETE /v1/watchlists/{id}, and watchlist tracker mutations. |
trackers:write | Any paid | POST /v1/trackers, PATCH /v1/trackers/{id}, DELETE /v1/trackers/{id}. |
recommendations:read | Pro+ | GET /v1/recommendations, GET /v1/entities/{id}/recommendations, GET /v1/channels/{id}/sponsors, GET /v1/mentions?details=full, and the recommendations_summary blocks on entity/channel reads. |
recommendations:write | Pro+ | POST /v1/feedback. |
read cannot be removed. The dashboard hides the toggle to make that explicit.
The two
recommendations:* scopes are only visible in the dashboard on Pro+ plans (pro_plus, ultra, teams, enterprise). On hobby and base pro, the toggles are hidden and the commercial routes return 403 recommendations_not_enabled regardless of scope.Choosing scopes
- Read-only integrations (analytics, dashboards, BI exports) should mint a key with
readonly. That key cannot create or delete anything. - Automation that creates trackers (CRM enrichment, watchlist sync, GTM signals) needs
trackers:writeand probablywatchlists:writeif it also creates lists. - Commercial intelligence integrations (advertiser dashboards, sponsor research, ad-spend modeling) need
recommendations:read. Addrecommendations:writeif you’ll be submitting corrections throughPOST /v1/feedback. - Per-environment keys. Mint one key per environment and per process. Don’t reuse production keys in CI.
Inspecting a key’s scopes
recommendations_api_enabled is the tier-level gate. It’s true on Pro+ tiers and false everywhere else, independent of the scopes granted to the key. If it’s false, the commercial routes will 403 even if you’ve somehow attached the scope.