Scopes

A scope is a permission to access part of your Bitrix24 data or a section of the Vibecode platform. When creating a key, choose the minimal set of scopes sufficient for the task: the fewer permissions a key has, the smaller the impact if it is compromised.

Scopes are selected in the key creation form in two groups — "Bitrix24" and "Vibecode". At least one scope is required. The set of Bitrix24 scopes is locked to the key at the moment of issue. If you add a Bitrix24 scope in the settings of an existing key, GET /v1/me shows it in the list, but the key keeps accessing Bitrix24 data with its original set — requests that need the new scope return a BITRIX_ACCESS_DENIED error. You can obtain a new Bitrix24 scope only by re-issuing the API key or re-creating the application (for an authorization key) with that scope — the procedure is described on the Creating a key page.

For a step-by-step walkthrough of the entire key creation form, see Creating a key.

How to choose scopes for a task

Quick reference: which scopes you need for a typical application scenario.

Task	Scopes
Dashboard for deals, contacts, and companies	`crm`, `user`
Sending messages and notifications to a chat (`POST /v1/notifications`, `POST /v1/chats/:dialogId/messages`)	`im`
Posting to the Feed (`POST /v1/posts`)	`log`
Chatbot in the Bitrix24 messenger	`imbot`, `im`
Managing tasks	`task`, `tasks`, `user`
Workgroups and projects	`sonet_group`
Working with files on Drive	`disk`
Online store: orders and catalog	`sale`, `catalog`
Telephony and call log	`telephony`, `call`
Employee calendar and events	`calendar`, `user`
Employee profiles and org structure	`user`, `department`
Application's own data storage	`entity`
Workflows and automation	`bizproc`

If several modules are involved in a scenario, specify several scopes.

Full table of Bitrix24 scopes

The complete list of Bitrix24 scopes.

Scope	What it grants
`crm`	Deals, leads, contacts, companies, invoices, and other CRM entities
`task`	Tasks. To work with tasks, select it together with `tasks`
`tasks`	Tasks, subtasks, checklists, comments, time tracking. To work with tasks, select it together with `task`
`im`	Sending and reading chat messages
`imbot`	Registering and managing chatbots
`imopenlines`	Open Channels: customer inquiries
`imconnector`	Connectors for external messengers (Open Channels)
`call`	Managing calls and telephony
`telephony`	Integration with external telephony and call management
`bizproc`	Launching and managing workflows
`calendar`	Access to employee calendars and events
`timeman`	Time tracking and attendance control
`catalog`	Working with the trade catalog and products
`sale`	Orders, payments, deliveries — the online store module
`lists`	Universal lists and list items
`disk`	Uploading, downloading, and managing files on Drive
`entity`	Application's custom data storage
`user`	User profiles — full set of fields
`user_basic`	User profiles — reduced set of fields
`user_brief`	User profiles — minimal set of fields
`user.userfield`	Custom user fields
`department`	Company structure and departments
`landing`	Managing sites and landing pages
`documentgenerator`	Generating documents from templates
`sign.b2e`	Electronic document signing between an employee and the company
`sonet_group`	Workgroups and projects in the social network
`log`	Feed: posts, comments, reactions
`vote`	Working with polls and votes
`ai_admin`	Administering Bitrix24 AI services
`biconnector`	Business analytics and connecting external BI systems
`booking`	Managing bookings and schedules
`delivery`	Configuring and managing delivery services
`pay_system`	Configuring and managing payment systems
`main`	Basic service methods of the Bitrix24 account: settings, events
`placement`	Embedding interfaces in various places of Bitrix24. How to bind a placement — Placements
`userfieldtype`	Registering custom user field types
`humanresources`	Org structure: departments, teams, employees
`mail`	Mailboxes, emails, senders
`contact_center`	Contact Center: placing the application tile (Open Channels connectors). Required for the `CONTACT_CENTER` placement

Vibecode platform scopes

Vibecode platform scopes control access to sections of the platform itself, not to Bitrix24 data.

Scope	What it grants
`vibe:infra`	Managing servers, tunnels, and infrastructure
`vibe:ai`	Access to the platform's AI models
`vibe:feedback`	Sending feedback via the API
`vibe:search`	Web search across external sources via the platform
`vibe:storage`	Platform file storage: uploading and storing objects

Reserved scopes

The "Vibecode" tab of the key creation form shows three more ticked entries — vibe:security, vibe:analytics, vibe:airouter. They cannot be changed and they do not affect the key's rights: the set returned by GET /v1/me does not include them.

Platform scopes are pre-selected

Every Vibecode scope is pre-selected in the key creation form, so a key issued without touching the form gets the full set:

vibe:infra
vibe:ai
vibe:search
vibe:storage
vibe:feedback

This is a pre-selection, not a forced grant: clear a checkbox and the key is issued without that right. A key holding only vibe:storage, for example, gets access to object storage and receives 403 when it tries to create a server or call AI.

You can also narrow the rights after issue, in the key settings. Issuing exactly the set you need is safer though: the key never exists, even briefly, with wider rights than required.

Two places where the four platform scopes are added for you:

the paired key of an application (vibe_app_) — its set is defined by the application, not by the key form. An application created with a key that has a fixed rights set is the exception: its paired key gets exactly what was declared in scopes, and the vibe:* right needed there is listed explicitly, see Create an application.
POST /v1/keys without exactScopes — the previous behaviour is preserved so that scripts already written keep their rights. Need the exact set — pass exactScopes: true, see Management keys.

Management key scopes

A management key uses a separate set of scopes (vibe:mgmt:keys, vibe:mgmt:portals, vibe:mgmt:feedback) and has no access to Bitrix24 data. Full description — Management keys.