Permissions

Each API key has a permission grid with one row per resource. Each row is set to none, read or write, and write includes read. The owner sets the grid when creating the key and can change it at any time. The Full access preset sets every row to its highest level, except date of birth, which is always opt-in.

Resource	Levels	Read gives you	Write adds
products	none / read / write	Products, prices, cost, categories, vendors	Create, update and delete products
inventory	none / read / write	On-hand quantity per location, lots with their lot number and expiry, serialized units with serial numbers, the stock-movement ledger	Adjust or set counts on products tracked by quantity (not serialized, not lot-tracked)
customers	none / read / write	Names, contact details, addresses, customer group, tags, marketing opt-in, store credit balance, spend totals	Create and update customers
customer_dob	none / read	Adds date_of_birth wherever a customer appears (customers, orders, the events feed) and lets you set it	–
orders	none / read / write	Register sales, API orders, their lines and payments	Create orders; void orders
returns	none / read	Returns and refunds with their lines	–
purchase_orders	none / read / write	Purchase orders, their lines and quantities received	Create, edit, submit and cancel purchase orders; receive non-serialized lines against them, which adds stock (lot-tracked lines take a lot number)
gift_certificates	none / read / write	Codes, balances and their ledger	Issue certificates; redeem, reverse, reload and adjust balances (Idempotency-Key required); disable and enable
store_credit	none / read / write	Customer store credit balances and the credit ledger	Issue credit (a refund or an adjustment) and redeem it (Idempotency-Key required)
coupons	none / read / write	Codes, rules and usage	Create, edit and delete coupons (store+online ones sync to BigCommerce)
locations	none / read / write	Store names, addresses, hours, time zones, tax rates	Update phone, email and business hours only

Notes:

• Missing permission. Calling an endpoint without the permission it needs returns 403 INSUFFICIENT_SCOPE, with the permission named in details.required, e.g. "products:read".
• Customers on orders. A key without customers:read sees only { "object": "customer", "id": … } on an order, not the customer's details.
• Customers created by orders. orders:write can create the buyer as a customer while creating an order, even without customers:write. The order is the reason the customer exists.

Never available

Some records aren't in the grid at all, so no key can reach them at any level:

• Customer identity documents: ID type, number, issuing state and expiry.
• Staff-only notes on customers, and tax-exemption certificate numbers.
• Staff and users: logins, PINs, roles and permissions.
• Billing: the shop's own Black Beach POS subscription.

Serial numbers and lots are read-only. You can read a serialized unit's serial number and a lot's number, expiry and quantity (inventory:read), but no endpoint creates or changes a serialized unit or a lot's quantity directly. Units and lots come in through receiving (the Receiving screen, or receiving a purchase order for lots) and leave through sales, returns and adjustments made in Black Beach POS.