Scopes

A B2B key carries a list of scopes; missing a required scope returns 403 with api_key.scope_denied.

Scope	Routes it unlocks
works:register	All POST /v1/works/init | /prepare | /confirm
works:update	All POST /v1/works/{ats_id}/versions/init | /init-upload | /prepare | /confirm
works:read	GET /v1/works, GET /v1/works/{ats_id}/..., and the /v1/works/{work_uuid}/download/... endpoints

Pick the smallest set that matches your integration. You can mix scopes on a single key (most partners use works:register + works:update together).