Roles and scopes

Role

Role	What it does
customer	Books, pays, tracks and confirms the job, decides on extra work and quotes
usta	Sees the job pool, accepts and runs jobs, raises extra work and quotes

Catalog, account, notification, chat and support endpoints are open to both roles. The reference states each endpoint's role in its Access line; the wrong role gets 403 PARTNER_ROLE_REQUIRED.

Scopes

Scope	Covers
read	Every GET
write	State changes that move no money: opening a booking, adding photos, accepting a job, sending a message
money	Every step that starts or directs money: opening a payment, confirming a job, refunds, disputes, accepting extra work or a quote, approving a payout

* grants all three. A key without the scope gets 403 PARTNER_SCOPE_REQUIRED, and the answer names the scope it needed (required_scope).

Least privilege

A dashboard that only shows bookings needs read. If payments do not start from your system, do not ask for money.