Scopes

Request the smallest set of permissions your plugin needs. Happa enforces scopes on every API request, and users see the scope list when they install your plugin.

Available scopes

Scope	What it unlocks
`events.read`	Read organizer-owned events, event comments, and event polls.
`events.write`	Patch an event's description, location, and date.
`attendees.read`	List attendees for organizer-owned events.
`attendees.write`	Add or remove attendees on organizer-owned events.
`profile.read`	Read the installing organizer's profile, follower count, and following count.
`tickets.read`	Read aggregate ticket sales and revenue totals for organizer-owned events.

Recommended scope bundles

Plugin type	Recommended scopes
CRM sync	`events.read`, `attendees.read`, `profile.read`
Operations dashboard	`events.read`, `attendees.read`, `tickets.read`
Attendance automation	`attendees.read`, `attendees.write`, `events.read`
Event maintenance tool	`events.read`, `events.write`

Least-privilege rules

Ask for events.write only if your plugin truly edits event fields.
Use tickets.read for revenue dashboards instead of broader attendee access when you do not need identities.
If you need poll data, start with events.read; current poll endpoints inherit that scope.
Review your requested scopes whenever you submit a major plugin update.

Common mistakes

Symptom	Likely fix
`403 Scope attendees.read not granted`	Add `attendees.read` to the plugin draft and reinstall the plugin.
Poll endpoint returns `403`	Grant `events.read` to the installation.
Revenue endpoint returns `403`	Add `tickets.read`; attendee scopes do not include ticket revenue.

Reinstall after scope changes: changing scopes on a draft affects future installations. Existing installations keep the scopes they already received until the user reinstalls.

Financial workflows: scopes alone are not enough for payment-sensitive plugins. Review the separate Financial Plugins requirements before you submit that category.