# Commerce API scopes (https://developer.godaddy.com/en/docs/references/rest/commerce-scopes)

***

title: Commerce API scopes
description: PAT scopes for the GoDaddy Commerce APIs, and the endpoints each scope unlocks.
full: true
----------

Commerce APIs use PAT scopes to authorize requests.

Scopes follow the pattern `commerce.<resource>:<action>`.

## Permission values

The `:<permission>` suffix on a scope maps to the HTTP methods it unlocks:

| Permission | Use for                                            | HTTP methods              |
| ---------- | -------------------------------------------------- | ------------------------- |
| `read`     | Read-only access                                   | `GET`                     |
| `write`    | Create and update combined                         | `POST`, `PATCH`, `PUT`    |
| `create`   | Create only (when separate from update)            | `POST`                    |
| `update`   | Update only (when separate from create)            | `PATCH`, `PUT`            |
| `delete`   | Delete access                                      | `DELETE`                  |
| `execute`  | Other operations (usually with an operation field) | varies                    |
| `cancel`   | Cancel a resource                                  | `POST` (GraphQL mutation) |
| `complete` | Complete a resource                                | `POST` (GraphQL mutation) |
| `archive`  | Archive a resource                                 | `POST` (GraphQL mutation) |

## Store

| Scope                 | Grants                 | Endpoints                                                                                    |
| --------------------- | ---------------------- | -------------------------------------------------------------------------------------------- |
| `commerce.store:read` | Read store information | `GET /v1/commerce/stores/{storeId}``GET /v1/commerce/stores/{storeId}/attributes/{attrName}` |

## Channel

| Scope                   | Grants              | Endpoints                                                          |
| ----------------------- | ------------------- | ------------------------------------------------------------------ |
| `commerce.channel:read` | Read sales channels | `GET /v1/commerce/channels``GET /v1/commerce/channels/{channelId}` |

`GET /v1/commerce/channels/{channelId}` checks access on that specific channel. A PAT that can list channels for a store may still receive `401` on get-by-id. List channels and filter instead:

```bash
curl -s "https://api.godaddy.com/v1/commerce/channels?registeredStores.storeId=${STORE_ID}" \
  -H "Authorization: Bearer $GODADDY_PAT" \
  | jq '.items[] | select(.channelId == "<CHANNEL_ID>")'
```

## Customer

| Scope                      | Grants                      | Endpoints                                                                                               |
| -------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------- |
| `commerce.customer:read`   | Read customers              | `GET /v1/commerce/stores/{storeId}/customers``GET /v1/commerce/stores/{storeId}/customers/{customerId}` |
| `commerce.customer:create` | Create customers            | `POST /v1/commerce/stores/{storeId}/customers`                                                          |
| `commerce.customer:update` | Update customer information | `PATCH /v1/commerce/stores/{storeId}/customers/{customerId}`                                            |

## Product (Catalog GraphQL)

| Scope                    | Grants                     | Endpoint                                              |
| ------------------------ | -------------------------- | ----------------------------------------------------- |
| `commerce.product:read`  | Read products              | `POST /v2/commerce/stores/{storeId}/catalog-subgraph` |
| `commerce.product:write` | Create and update products | `POST /v2/commerce/stores/{storeId}/catalog-subgraph` |

## Order (Order GraphQL)

| Scope                     | Grants          | Endpoint                           |
| ------------------------- | --------------- | ---------------------------------- |
| `commerce.order:read`     | Read orders     | `POST /v1/commerce/order-subgraph` |
| `commerce.order:create`   | Create orders   | `POST /v1/commerce/order-subgraph` |
| `commerce.order:update`   | Update orders   | `POST /v1/commerce/order-subgraph` |
| `commerce.order:cancel`   | Cancel orders   | `POST /v1/commerce/order-subgraph` |
| `commerce.order:complete` | Complete orders | `POST /v1/commerce/order-subgraph` |

## Tax (Tax GraphQL)

| Scope                 | Grants                 | Endpoint                                          |
| --------------------- | ---------------------- | ------------------------------------------------- |
| `commerce.tax:read`   | Read taxes and rates   | `POST /v2/commerce/stores/{storeId}/tax-subgraph` |
| `commerce.tax:create` | Create taxes and rates | `POST /v2/commerce/stores/{storeId}/tax-subgraph` |
| `commerce.tax:write`  | Update taxes and rates | `POST /v2/commerce/stores/{storeId}/tax-subgraph` |
| `commerce.tax:delete` | Delete taxes and rates | `POST /v2/commerce/stores/{storeId}/tax-subgraph` |

## Transaction

| Scope                       | Grants            | Endpoints                                                                                                        |
| --------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------- |
| `commerce.transaction:read` | Read transactions | `GET /v2/commerce/stores/{storeId}/transactions``GET /v2/commerce/stores/{storeId}/transactions/{transactionId}` |