> ## Documentation Index
> Fetch the complete documentation index at: https://developers.goparlay.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and data access

> What each key permission unlocks, and which calls a key can see.

## Permissions

Each key carries a list of permissions chosen when it was created. A request that needs a permission the key does not have returns `403 forbidden`.

### Read

| Permission | Unlocks |
| - | - |
| `calls:read` | Calls, the change feed, scores, analysis, metrics, coaching, call status and call outcomes |
| `transcripts:read` | Transcript text, timed segments and transcript search |
| `reps:read` | Reps, teams and team members |
| `analytics:read` | Overview, leaderboard, trends, insights, activity, pillars, outcomes, rep and team performance, and rep coaching synthesis |
| `deals:read` | Deals, and the links between calls and deals |
| `crm:read` | Accounts and pipeline stages |
| `contacts:read` | Contacts, including names, emails and phone numbers |
| `configuration:read` | Playbook, playbook versions, scorecard and trackers |
| `comments:read` | Coaching comments on calls |
| `playlists:read` | Organization playlists and the calls in them |
| `training:read` | Courses, videos, enrollments, progress and certificates |
| `usage:read` | Organization and per-key usage |
| `audit:read` | The organization audit trail |

Write, webhook, export and audio permissions are coming with those features and can't be selected yet.

`GET /organization` works with any key. Endpoints that join two kinds of data need both permissions. For example, `GET /deals/{deal_id}/calls` needs `deals:read` **and** `calls:read`.

## Which calls a key can see

A key sees the calls that belong to its organization. A few rules keep that boundary exact:

* **Calls stay with the organization they were recorded in.** If a rep later moves to another organization, their past calls stay with the original one.
* **Owner keys** see all of the organization's calls.
* **Admin keys** follow the organization's admin retention setting, so they see the same window an admin sees in the app.
* **Private meeting notes** and Parlay staff recordings are never returned.
* **Deleted or hidden calls** return `404`, and the [change feed](https://developers.goparlay.io/app-api/guides/daily-sync.md) emits a `call.deleted` event so you can remove your copy.

A key never sees another organization's data. A call id from another organization returns `404 not_found`, the same as an id that does not exist, so the API never confirms that someone else's call exists.

## Checking a key's access

`GET /me` lists the key's permissions. `GET /capabilities` reports which optional features are switched on for your organization.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.