Every API key issued in ROLLER Venue Manager carries a scope — the set of endpoints the key is allowed to call. When your application calls an endpoint outside its scope, the API responds:
JSON
HTTP 403 Forbidden
{ "Message": "Invalid scope" }An API key holds one of the following:
Model What it grants REST API full access Every REST API endpoint (bookings, payments, products, guests, discounts, redemptions, webhooks, venue, resources) — except restricted endpoints Reporting API full access Every Data API and reporting endpoint (/data/*, /reporting/*) Granular scopes An explicit list of endpoint scopes from the catalog below — nothing else
🚧 When you request API access for a venue, request only the scopes your integration needs — venues see and approve what your key can do.
Each operation in the API Reference lists its required scope. A typical marketplace vendor checkout integration needs:
Text
ProductAvailability_Get Product_Get
BookingDraft_Create BookingDraft_Costs BookingDraft_Publish
Booking_Get Booking_Cancel
Payment_Create
Webhook_Create Webhook_Get Webhook_GetFailedMessagesAdd Data_* / Reporting_* scopes (or Reporting API full access) if you reconcile sales with the Data API.
Scope Grants API Endpoint Booking_GetGet booking detail REST API GET /bookings/{uniqueId}Booking_SearchSearch bookings REST API GET /bookingsBooking_CreateCreate booking REST API POST /bookingsBooking_UpdateUpdate booking REST API PUT /bookings/{uniqueId}Booking_CancelCancel booking REST API POST /bookings/{uniqueId}/cancelBooking_DeleteDelete booking REST API DELETE /bookings/{uniqueId}BookingDraft_CreateCreate draft booking REST API POST /bookings/draftBookingDraft_CostsGet booking costs REST API POST /bookings/draft/costsBookingDraft_PublishPublish draft booking REST API POST /bookings/draft/publishBookingFormResponse_GetGet booking form responses REST API GET /bookings/{uniqueId}/form-responsesBookingResources_GetGet booking resources REST API GET /bookings/{uniqueId}/resourcesBookingResources_PostUpdate booking resources REST API POST /bookings/{uniqueId}/resources
Scope Grants API Endpoint CapacityReservation_CreateValidate & reserve capacity REST API POST /capacity-reservationCapacityReservation_DeleteDelete capacity reservation REST API DELETE /capacity-reservation/{uniqueId}CapacityBlock_CreateBlock resource capacity REST API POST /capacity-reservation/blockCapacityBlock_GetGet resource capacity block REST API GET /capacity-reservation/block/{blockId}CapacityBlock_SearchSearch capacity blocks REST API GET /capacity-reservation/blockCapacityBlock_DeleteDelete capacity block REST API DELETE /capacity-reservation/block/{blockId}
Scope Grants API Endpoint Discount_GetGet discount REST API GET /discounts/{discountId}Discount_CreateCreate discount REST API POST /discountsDiscount_UpdateUpdate discount REST API PUT /discounts/{discountId}Discount_ValidateValidate discounts REST API POST /discounts/validateDiscountCode_CreateCreate discount codes REST API POST /discounts/{discountId}/codesDiscountCode_DeleteDelete discount codes REST API DELETE /discounts/{discountId}/codes
Scope Grants API Endpoint Guest_GetGet guest detail REST API GET /guests/{guestId}Guest_UpdateUpdate guest detail REST API PUT /guests/{guestId}Customer_GetGet customer detail REST API GET /customers/{customerId}CustomerMultiPass_GetGet guest multi-passes REST API GET /customers/{customerId}/multi-passesSignedWaiver_GetGet signed waiver REST API GET /signed-waivers/{signedWaiverId}SignedWaiverFormResponses_GetGet signed waiver form responses REST API GET /signed-waivers/{signedWaiverId}/form-responses
Scope Grants API Endpoint ProductAvailability_GetGet product availability REST API GET /product-availabilityProduct_GetGet product detail REST API GET /productsProduct_Create_StockCreate stock products REST API POST /products/stockProduct_Update_StockUpdate stock products REST API PUT /products/stockProduct_Update_StockQuantityUpdate stock quantity REST API PUT /products/stock/{parentProductId}/quantity
Scope Grants API Endpoint Redemption_RedeemTicketsRedeem tickets REST API POST /redemptions
Scope Grants API Endpoint Resource_GetGet resources REST API GET /resourcesResourceCalendar_GetGet resource calendar REST API GET /resources/calendar/daily
Scope Grants API Endpoint Payment_CreateAdd payment to booking REST API POST /bookings/{uniqueId}/paymentsPaymentLink_PostCreate payment link REST API POST /bookings/{uniqueId}/payments/linksPaymentLink_DeleteCancel payment link REST API DELETE /bookings/{uniqueId}/payments/links/{paymentLinkId}
Scope Grants API Endpoint Venue_GetGet venue detail REST API GET /venues/me
Scope Grants API Endpoint Webhook_GetGet webhooks REST API GET /webhooksWebhook_CreateCreate webhook REST API POST /webhooksWebhook_UpdateUpdate webhook REST API PUT /webhooks/{webhookId}Webhook_DeleteDelete webhook REST API DELETE /webhooks/{webhookId}Webhook_GetFailedMessagesGet failed webhook messages REST API GET /webhooks/messages/failed
Scope Grants API Endpoint Staff_GetGet staff detail ⚠️ restricted REST API GET /staff/{uniqueId}Staff_CreateCreate staff ⚠️ restricted REST API POST /staffStaff_UpdateUpdate staff ⚠️ restricted REST API PUT /staff/{uniqueId}Staff_DeleteDelete staff ⚠️ restricted REST API DELETE /staff/{uniqueId}Staff_LockLock staff ⚠️ restricted REST API POST /staff/{uniqueId}/lockStaff_UnlockUnlock staff ⚠️ restricted REST API POST /staff/{uniqueId}/unlockStaff_SendInvitationSend staff invitation ⚠️ restricted REST API POST /staff/{uniqueId}/send-invitation
Scope Grants API Endpoint Data_AttendanceGet attendance Data API GET /data/attendancesData_BookingItemGet booking items Data API GET /data/bookingitemsData_BookingPaymentGet payments Data API GET /data/bookingpaymentsData_BookingSignedWaiverGet booking signed waivers Data API GET /data/bookingsignedwaiversData_CustomerGet customers Data API GET /data/customersData_DiscountGet discounts Data API GET /data/discountsData_GiftCardGet gift cards Data API GET /data/giftcardsData_LocationGet resources Data API GET /data/locationsData_MembershipRedemptionGet membership redemptions Data API GET /data/membershipredemptionsData_MembershipStatusGet membership statuses Data API GET /data/membershipstatusesData_MembershipCreditGet membership credits Data API GET /data/membershipcreditsData_ProductGet products Data API GET /data/productsData_ReportingCategoryGet reporting categories Data API GET /data/reportingcategoriesData_RevenueGet revenues Data API GET /data/revenuesData_SignedWaiverGet signed waivers Data API GET /data/signedwaiversData_StaffGet staff Data API GET /data/staffsData_TicketGet tickets Data API GET /data/ticketsData_WaiverGet waivers information Data API GET /data/waiversData_TillGet POS till reconciliations Data API GET /data/tillreconciliationsData_DeviceGet devices Data API GET /data/devicesData_ModifiersGet modifiers Data API GET /data/modifiersData_GxsGet GX Score responses Data API GET /reporting/gxsData_BookingAuditLogGet booking audit logs Data API GET /reporting/bookings/audit-logsData_RoleGet roles Data API GET /data/roles
Scope Grants API Endpoint Reporting_RevenueEntriesGet revenue entries Data API GET /reporting/revenue-entriesReporting_BulkRevenueBulk revenue activity export Data API POST /reporting/bulk/revenue-activityReporting_BulkDataExportBulk data export request Data API POST /reporting/bulk
Scope identifiers are case-sensitive and match the values shown above.
The /token endpoint requires no scope — any enabled key can request a token.
Legacy keys issued without a scope have unrestricted access; new keys are always scoped.
Scopes are configured when the key is created and can be updated in ROLLER Venue Manager (Settings → Integrations → API ) or by your ROLLER account manager.
