Substy Agencies and permissions
Limit access by agency, category, role, and creator.
A request must pass all four checks:
- The key belongs to the agency in the request URL.
- The key grants the relevant category and access level.
- The issuing user’s current role permits the action.
- The user can access the requested creator or resource.
A key may narrow your permissions; it cannot expand them. An owner and a chatter using the same API endpoint can therefore receive different accessible data or permission results.
Category access
Each category can be set to no access, read, or manage. Manage includes reading and performing actions, subject to the platform’s normal permissions.
| Category | Examples |
|---|---|
| Account | Account profile and security actions |
| Creators | Creator profiles and fan records |
| Inbox | Conversation history and scheduled messages |
| Analytics | Revenue, performance, and reports |
| Scripts | Scripts, launches, and solo bundles |
| Automations | Automation rules and audiences |
| Campaigns | Bulk messages, tracking links, and promotions |
| Media | Vault folders, media, and uploads |
| Publishing | Posts, stories, and scheduled publications |
| Scheduling | Shifts, time tracking, and payroll exports |
| Team | Members, invitations, and creator assignments |
| Billing | Existing wallet and subscription actions |
| Settings | Creator AI behavior and preferences |
| Intelligence | Intelligence history and delegated actions |
Intelligence can combine data from multiple categories. Its history requires read access across every available category; delegated actions and hosted browser access require manage access across every category. Start with the smallest set your integration needs.
Support and notification integrations are outside this API’s delegated operation catalog. Direct conversational fan replies are excluded. Do not use bulk or scheduled sending as a workaround for a direct reply.
Multiple agencies
Create a separate key for each agency. Use /v1/agencies to discover what the current key can access. Changing an agency identifier in the URL does not switch the key’s agency.
API access is enabled per agency. Contact your agency owner if access is unavailable.