# Scopes and presets

Every API key and connected app has scopes (what it may do) and an account scope (where it may do it). A tool needs one scope; a call outside the key’s scopes or accounts answers SCOPE_NOT_GRANTED or ACCOUNT_NOT_PERMITTED.

## Scopes
`accounts:read`, `accounts:manage` (profiles, connect links, moving and pausing accounts), `mail:read`, `mail:draft`, `mail:send`, `mail:organize` (move, archive, trash, read and flag state, labels, folders), `calendar:read`, `calendar:write`, `calendar:respond`, `approvals:read`, `usage:read`.

## Presets
The key dialog and the consent screen offer four presets:

| Preset | Scopes | Sends need approval |
|---|---|---|
| Read only | `accounts:read mail:read calendar:read usage:read` | Cannot send |
| Assistant (the default) | everything except `accounts:manage` | Yes |
| Full | everything | No |
| Custom | any combination | Your choice |

Creating a Full key asks the person to sign in again first. Each account’s own safety settings can still hold sends for approval, whatever the key says.

## Account scope
A key or connected app reaches all accounts in the workspace (including ones connected later), selected profiles (including accounts added to them later), or selected accounts.