What scopes exactly does the Wordpress API key need?

@angus Did this go anywhere? We’d like to use this on one of our wordpress sites where we have a less-than-tightly-controlled set of users with admin access, and I don’t want that to be an escalation into full admin access on our Discourse site.