Scopes
The scopes you can grant an API key, and which endpoints each one unlocks.
Scopes define which operations an API key is permitted to perform. Assign the minimum set of scopes required for your integration.
The public Data API is read-only — creating or updating tournaments, registering participants, and reporting match results are organizer actions performed from the dashboard, not exposed to API keys. The scopes below cover what a key can read from the Data API, subscribe to on the real-time stream, and — for anti-cheat integrations — write.
Tournament scopes
| Scope | Description |
|---|---|
read:tournaments | List and retrieve tournaments, stages, and brackets |
Match scopes
| Scope | Description |
|---|---|
read:matches | Retrieve match details, schedules, results, and normalized match events |
Player and team scopes
| Scope | Description |
|---|---|
read:player_stats | Retrieve a player's per-game statistics |
read:teams | Retrieve team details |
Real-time scopes
| Scope | Description |
|---|---|
stream:match_events | Subscribe to the public real-time match-event stream |
Beyond the request/response Data API, Tournament Suite exposes a real-time event stream for live match data — bracket updates, score changes, and match state transitions — delivered over a WebSocket connection instead of polling. An API key needs the stream:match_events scope to open a subscription; the key is passed the same way as any other API key request, not as a separate credential.
Anti-cheat scopes
The anti-cheat integration surface is the one part of the public API that accepts writes, for third-party integrators reporting session and detection data. It uses its own dedicated scopes:
| Scope | Description |
|---|---|
anticheat:session.write | Start and end anti-cheat monitoring sessions |
anticheat:detections.read | List and retrieve anti-cheat detection results |
anticheat:evidence.write | Upload evidence for an anti-cheat session |
Assigning scopes to an API key
Tournament Suite does not issue OAuth 2 access tokens for the public API — scopes apply to API keys, not to bearer tokens. Choose the scopes a key should carry when you generate it, from your project's Developer section of the organizer dashboard. A key's scopes can't be edited after creation, so rotate the key if you need to add or remove one later.
Every request authenticates with the key in the x-api-key header:
curl https://api.tournamentsuite.com/api/v1/data/tournaments \
-H "x-api-key: YOUR_API_KEY"If a key is missing a scope an endpoint requires, the API returns 403 Forbidden with a message identifying the missing scope. See Authentication and Authorization for the full request and error contract.
Looking for Tournament Suite's OAuth 2 support for organization single sign-on instead? See OAuth 2 — it's a separate system from API key scopes.
Scope minimization
It is good practice to grant only the scopes an API key actually uses. For example, a reporting dashboard that only reads data should use read:tournaments read:matches read:player_stats — not scopes it doesn't need.
If a key is ever compromised, a narrow scope set limits what an attacker can do with it.
Was this helpful?