Permissions

Each API key has a permission grid with one row per resource. Each row is set to none, read or write, and write includes read. The owner sets the grid when creating the key and can change it at any time. The Full access preset sets every row to its highest level, except date of birth, which is always opt-in.

Resource	Levels	Read gives you	Write adds
products	none / read / write	Products, prices, cost, categories, vendors	Create, update and delete products
inventory	none / read / write	On-hand quantity per location, serialized units with serial numbers, the stock-movement ledger	Adjust or set counts on non-serialized products
customers	none / read / write	Names, contact details, addresses, customer group, tags, marketing opt-in, store credit balance, spend totals	Create and update customers
customer_dob	none / read	Adds date_of_birth wherever a customer appears (customers, orders, the events feed) and lets you set it	–
orders	none / read / write	Register sales, API orders, their lines and payments	Create orders; void orders that have no firearm lines
returns	none / read	Returns and refunds with their lines	–
purchase_orders	none / read / write	Purchase orders, their lines and quantities received	Create, edit, submit and cancel purchase orders; receive non-serialized lines against them, which adds stock
gift_certificates	none / read / write	Codes, balances and each certificate's ledger	Issue certificates; redeem, reverse, reload and adjust balances (an Idempotency-Key is required); disable and enable
store_credit	none / read / write	Each customer's store credit balance and ledger	Issue credit (a refund or an adjustment) and redeem it (an Idempotency-Key is required)
accounts	none / read / write	House account terms and balances, invoices (with the orders they bill and pay links), account payments	Record a payment received elsewhere, applied to invoices (an Idempotency-Key is required)
memberships	none / read / write	Membership plans, members and their dues (with pay links and the member's save-a-card link)	Sign members up (billed by pay link or at the counter, or already paid on your channel), cancel, use guest passes
card_transactions	none / read	Every attempt at the shop's card processor: charges, declines, reversals and refunds. Never a card number or token.	–
coupons	none / read / write	Codes, rules and usage	Create, update and delete coupons; store_online ones sync to BigCommerce
locations	none / read / write	Store names, addresses, hours, time zones, tax rates	Update phone, email and business hours only
range	none / read / write	Lanes and bays, classes, sessions, availability, reservations, the rental-gun fleet and its checkout history	Book lanes and class seats; check in, mark no-show and cancel reservations

Notes:

• Range add-on. range can only be granted when the shop has the Range add-on.
• Missing permission. Calling an endpoint without the permission it needs returns 403 INSUFFICIENT_SCOPE, with the permission named in details.required, e.g. "products:read".
• Customers on orders. A key without customers:read sees only { "object": "customer", "id": … } on an order, not the customer's details.
• Customers created by orders. orders:write can create the buyer as a customer while creating an order, even without customers:write. The order is the reason the customer exists.

Never available

Some records aren't in the grid at all, so no key can reach them at any level:

• The bound book (Acquisition & Disposition record) and its events.
• ATF Form 4473: the form itself, its transferee data, and NICS / E-Check results.
• ATF Form 3310.4 (multiple handgun sales reports).
• FFL-to-FFL transfer records.
• Customer identity documents: ID type, number, issuing state and expiry.
• Staff-only notes on customers, and FFL and tax-exemption certificate numbers.

Some API fields and statuses use neutral names instead:

• An order whose firearm is waiting on the 4473 has status awaiting_transfer.
• A product or line that needs a 4473 has is_firearm: true.
• Stock received shows up as quantities, never as acquisition entries.

Serial numbers are read-only. You can read a serialized unit's serial number (inventory:read), but no endpoint creates, changes or disposes of a serialized unit. Each of those is a bound-book entry, and bound-book entries are made in Iron Register by the licensee.