Skip to main content

​
Permissions

Each key carries a list of permissions chosen when it was created. A request that needs a permission the key does not have returns 403 forbidden.

​
Read

Write, webhook, export and audio permissions are coming with those features and can’t be selected yet. GET /organization works with any key. Endpoints that join two kinds of data need both permissions. For example, GET /deals/{deal_id}/calls needs deals:read and calls:read.

​
Which calls a key can see

A key sees the calls that belong to its organization. A few rules keep that boundary exact:
  • Calls stay with the organization they were recorded in. If a rep later moves to another organization, their past calls stay with the original one.
  • Owner keys see all of the organization’s calls.
  • Admin keys follow the organization’s admin retention setting, so they see the same window an admin sees in the app.
  • Private meeting notes and Parlay staff recordings are never returned.
  • Deleted or hidden calls return 404, and the change feed emits a call.deleted event so you can remove your copy.
A key never sees another organization’s data. A call id from another organization returns 404 not_found, the same as an id that does not exist, so the API never confirms that someone else’s call exists.

​
Checking a key’s access

GET /me lists the key’s permissions. GET /capabilities reports which optional features are switched on for your organization.