The scope check runs before the controller: the request’s method and path are matched against a rule table, longest prefix wins, and the client must hold the rule’s scope or the matching resource:* wildcard. A refusal is HTTP 403 SCOPE_DENIED. This page is that rule table, restricted to scopes a partner client can hold, so you can read off which scopes to ask for.
Two things the table cannot tell you. First, holding the scope opens the route; whether a given account is yours to touch is decided afterwards by the ownership guard (see Ownership model). Second, a route with no rule is not scope-checked at all and needs only a valid token; the reference-data routes are the main example.
Agent routes (/api/legacy/agent/...) take X-Agent-Account naming the agent or merchant you act for, except admin/add_agent and downlines/{realId}/balance. The provider money routes (/api/legacy/provider/wallets/transactions/...) name accounts in the body; “wallets” in those paths is the previous core’s word for an account.
No route of its own. It is checked by the ownership guard whenever a money-movement route above names a sub-agent’s account as the source. See Acting on a sub-account’s money.
No agent route uses it today. It opens the platform’s native /api/kyc-documents reads, which are not part of the partner offering; see the note on KYC uploads.
The rule table also maps the platform’s native resource routes to the same scopes: GET/POST /api/accounts (accounts:read / accounts:create), POST /api/transactions/deposit, GET /api/transactions (transactions:deposit / transactions:read), POST /api/nip-transfers (nip:transfer), GET/POST /api/bill-payments (bill-payments:read / bill-payments:create), GET/POST /api/virtual-accounts (accounts:read / accounts:create), POST /api/external-transfers/debit and GET /api/external-transfers/{ref}/status (external-transfers:debit / external-transfers:read).
A partner client can never be granted *:*, agents:*, agents:create, kyc:* or kyc:manage; a request to create one with those scopes is refused with FORBIDDEN_PARTNER_SCOPE. The routes behind them:
Method
Path
Scope
Note
POST
/api/legacy/agent/admin/add_agent
agents:create
Open to you through sub-agents:create instead, which parents the agent to your client
These customer-account routes exist for the bank’s own channel servers. A partner’s estate is its own accounts and the agents and merchants it onboards (individuals or registered businesses, through admin/add_agent); it does not open or manage accounts for the bank’s other customers, so the customers:* scopes are not issued to partner clients.