What scopes does an OAuth connection carry?
OAuth connections carry scopes; API keys do not, and are bounded by folder permissions instead.
Senso advertises only kb.read up front, so a fresh connector is read-only. Calling a write tool without the scope returns 403 and the client prompts you to re-authorize.
Deletion is split out from writing on purpose: a connector allowed to add documents should not be able to empty a knowledge base.
| Scope | Grants | Endpoints it unlocks |
|---|---|---|
| kb.read | Read documents and search | POST /org/search*, GET /org/kb/* |
| kb.write | Create and update content | POST /org/kb/raw, POST /org/kb/upload |
| kb.delete | Remove nodes and subtrees | DELETE /org/kb/nodes/{id} |
Call it