Permissions
Assign least-privilege access using the exact permissions available in Daily.
Select at least one read permission when creating a key. The API checks the required permission after authentication, subscription, and IP restrictions. A missing permission returns 403 insufficient_permission.
| Product label (exact) | Permission | Protected endpoints | Purpose |
|---|---|---|---|
| פרטי העסק | business:read | GET /business | Business identity, contact details, and basic configuration. |
| לקוחות | customers:read | GET /customers, GET /customers/{id} | Customer records and their saved contact data. |
| ספקים | suppliers:read | GET /suppliers, GET /suppliers/{id} | Supplier records and their saved contact data. |
| לידים | leads:read | GET /leads, GET /leads/{id} | Leads, contact data, status, and assigned owner summary. |
| מוצרים ושירותים | products:read | GET /products, GET /products/{id} | Products, raw materials, prices, and catalog metadata. |
| מסמכים | documents:read | GET /documents, GET /documents/{id}, GET /documents/{id}/pdf | Documents, line items, relationships, and available PDFs. |
| תשלומים | payments:read | GET /payments, GET /payments/{id} | Recorded payments and document relationships, without sensitive payment details. |
| מלאי | inventory:read | GET /inventory, GET /inventory/movements | Inventory levels and inventory movements. |
| משימות | tasks:read | GET /tasks, GET /tasks/{id} | Tasks, dates, statuses, and linked business objects. |
Least privilege
Create a separate key per integration and enable only the rows it needs. This limits exposure, makes usage visible by key, and lets you rotate or revoke one integration without interrupting another.
Permissions can be edited later in Daily. Removing a permission takes effect on subsequent requests; no new key is required.
Missing-permission response
{
"error": {
"type": "authorization_error",
"code": "insufficient_permission",
"message": "This API key cannot access customers."
},
"request_id": "req_docspermissions01"
}Treat this response as configuration failure. Do not retry it automatically; ask the primary business owner to review the key's permissions.