Scopes

A scope is a permission to access part of your Bitrix24 data or a section of the Vibecode platform. When creating a key, choose the minimal set of scopes sufficient for the task: the fewer permissions a key has, the smaller the impact if it is compromised.

Scopes are selected in the key creation form, split into two groups — "Bitrix24" and "Vibecode". At least one scope is required. The set of Bitrix24 scopes is locked to the key at issue time. If you add a Bitrix24 scope in the settings of an existing key, GET /v1/me shows it in the list, but the key keeps accessing Bitrix24 data with its original set — requests that need the new scope return a BITRIX_ACCESS_DENIED error. You can obtain a new Bitrix24 scope only by re-issuing the API key or re-creating the application (for an authorization key) with that scope — the procedure is described on the Creating a key page.

For a step-by-step walkthrough of the entire key creation form, see Creating a key.

How to choose scopes for a task

Quick reference: which scopes you need for a typical application scenario.

Task	Scopes
TaskDashboard for deals, contacts, and companies	Scopescrm, user
TaskSending messages and notifications to a chat (POST /v1/notifications, POST /v1/chats/:dialogId/messages)	Scopesim
TaskPosting to the Feed (POST /v1/posts)	Scopeslog
TaskChatbot in the Bitrix24 messenger	Scopesimbot, im
TaskManaging tasks	Scopestask, tasks, user
TaskWorkgroups and projects	Scopessonet_group
TaskWorking with files on Drive	Scopesdisk
TaskOnline store: orders and catalog	Scopessale, catalog
TaskTelephony and call log	Scopestelephony, call
TaskEmployee calendars and events	Scopescalendar, user
TaskEmployee profiles and org structure	Scopesuser, department
TaskApplication's own data storage	Scopesentity
TaskWorkflows and automation	Scopesbizproc

If several modules are involved in a scenario, specify several scopes.

Full table of Bitrix24 scopes

The complete list of Bitrix24 scopes.

Scope	What it grants
Scopecrm	What it grantsDeals, leads, contacts, companies, invoices, and other CRM entities
Scopetask	What it grantsTasks. To work with tasks, select it together with tasks
Scopetasks	What it grantsTasks, subtasks, checklists, comments, time tracking. To work with tasks, select it together with task
Scopeim	What it grantsSending and reading chat messages
Scopeimbot	What it grantsRegistering and managing chatbots
Scopeimopenlines	What it grantsOpen Channels: customer inquiries
Scopeimconnector	What it grantsConnectors for external messengers (Open Channels)
Scopecall	What it grantsManaging calls and telephony
Scopetelephony	What it grantsIntegration with external telephony and call management
Scopebizproc	What it grantsLaunching and managing workflows
Scopecalendar	What it grantsAccess to employee calendars and events
Scopetimeman	What it grantsTime tracking and attendance monitoring
Scopecatalog	What it grantsWorking with the trade catalog and products
Scopesale	What it grantsOrders, payments, deliveries — the online store module
Scopelists	What it grantsUniversal lists and list items
Scopedisk	What it grantsUploading, downloading, and managing files on Drive
Scopeentity	What it grantsApplication's custom data storage
Scopeuser	What it grantsUser profiles — full set of fields
Scopeuser_basic	What it grantsUser profiles — reduced set of fields. This scope does not grant access to the /v1/users section
Scopeuser_brief	What it grantsUser profiles — minimal set of fields. This scope does not grant access to the /v1/users section
Scopeuser.userfield	What it grantsCustom user fields
Scopedepartment	What it grantsCompany structure and departments
Scopelanding	What it grantsManaging sites and landing pages
Scopedocumentgenerator	What it grantsGenerating documents from templates
Scopesign.b2e	What it grantsElectronic document signing between an employee and the company
Scopesonet_group	What it grantsWorkgroups and projects in the social network
Scopelog	What it grantsFeed: posts, comments, reactions
Scopevote	What it grantsWorking with polls and voting
Scopeai_admin	What it grantsAdministering Bitrix24 AI services
Scopebiconnector	What it grantsBusiness analytics and connecting external BI systems
Scopebooking	What it grantsManaging bookings and schedules
Scopedelivery	What it grantsConfiguring and managing delivery services
Scopepay_system	What it grantsConfiguring and managing payment systems
Scopemain	What it grantsBasic service methods of the Bitrix24 account: settings, events
Scopeplacement	What it grantsEmbedding interfaces in various places within Bitrix24. How to bind a placement — Placements
Scopeuserfieldtype	What it grantsRegistering custom user field types. The Vibecode API does not proxy these methods — fields of the built-in types are available in the User fields section
Scopehumanresources	What it grantsOrg structure: departments, teams, employees
Scopemail	What it grantsMailboxes, emails, senders
Scopecontact_center	What it grantsContact Center: placing the application tile (Open Channels connectors). Required for the CONTACT_CENTER placement

user_basic and user_brief are not substitutes for user. The methods of the Employees section — list, get by ID, search, fields, current employee profile — accept the full user scope only, and a key without it gets 403 SCOPE_DENIED. The reduced scopes are accepted by GET /v1/workday/records: there, any one of user_brief, user_basic, or user together with timeman is enough.

Vibecode platform scopes

Vibecode platform scopes control access to sections of the platform itself, not to Bitrix24 data.

Scope	What it grants
Scopevibe:infra	What it grantsManaging servers, tunnels, and infrastructure
Scopevibe:ai	What it grantsAccess to the platform's AI models
Scopevibe:feedback	What it grantsSending feedback via the API
Scopevibe:search	What it grantsWeb search across external sources via the platform
Scopevibe:storage	What it grantsPlatform file storage: uploading and storing objects
Scopevibe:connectors	What it grantsA linked application's access to the shared connectors of the Bitrix24 account; granted explicitly

vibe:connectors is an explicit application-host permission, not an automatically added platform scope. It requires an active application and its personal key or OAuth application key, with a matching owner and Bitrix24 account. While the feature is not enabled for the account, routes return 404 ROUTE_NOT_FOUND. Only shared PORTAL connections allowed by the administrator and by the key owner's permissions are available; no employee-viewer access is granted, and no connection or administrator rule is created. The exact allowlist of four routes, charges to the Bitrix24 account, the daily cap with UTC day boundaries and owner approval in the web account are described in Connector gateway and Connector host.

Reserved scopes

The "Vibecode" tab of the key creation form shows three more ticked entries — vibe:security, vibe:analytics, vibe:airouter. They cannot be changed and they do not affect the key's rights: the set returned by GET /v1/me does not include them.

Platform scopes are pre-selected

The regular Vibecode scopes listed below are pre-selected in the key creation form, so a key issued without touching the form gets the full set:

• vibe:infra
• vibe:ai
• vibe:search
• vibe:storage
• vibe:feedback

This is a pre-selection, not a forced grant: clear a checkbox and the key is issued without that right. A key holding only vibe:storage, for example, gets access to object storage and receives 403 when it tries to create a server or call AI.

You can also narrow the rights after issue, in the key settings. Issuing exactly the set you need is safer though: the key never exists, even briefly, with wider rights than required.

A key issued to a third-party application through Partner Connect is the exception to both rules below: platform scopes are never added to it, and it carries exactly what the user confirmed on the consent page. An application requests vibe:ai itself, vibe:storage is not available to it, and the other platform scopes are granted to it by a platform administrator.

Two places where the four platform scopes are added automatically:

• the paired key of an application (vibe_app_) — its set is defined by the application, not by the key form. An application created with a key that has a fixed rights set is the exception: its paired key gets exactly what was declared in scopes, and any vibe:* right it needs is listed there explicitly, see Create an application.
• POST /v1/keys without exactScopes — the previous behaviour is preserved so that existing scripts keep their rights. If you need the exact set, pass exactScopes: true; see Management keys.

Management key scopes

A management key uses a separate set of scopes (vibe:mgmt:keys, vibe:mgmt:portals, vibe:mgmt:feedback) and has no access to Bitrix24 data. For the full description, see Management keys.

See also

• Creating a key
• Quickstart
• Management keys
• API overview