### API scopes

Each token is issued with one or more **scopes** that gate which
parts of the API it can call. A scope is a named permission on the
token (for example `business`, `clock`, `payroll`, `absence`,
`external_employees`, `information_lines`); every operation
declares the scope it requires, and the scope must be **enabled on
your token** before that operation will accept the request. A
token without the required scope is rejected with `403 Forbidden`,
even when the token itself is otherwise valid.

Scopes are issued per integration, you do not pick them yourself.
Ask a Dyflexis administrator to enable the scopes you need when you request your
token. The required scope is listed on each operation.