# What scope is needed for acessing {{localhost}}/posts.json?
**URL:** https://meta.discourse.org/t/what-scope-is-needed-for-acessing-localhost-posts-json/180358
**Category:** Development
**Created:** [February 19, 2021, 4:50pm UTC](https://meta.discourse.org/t/what-scope-is-needed-for-acessing-localhost-posts-json/180358 "2021-02-19T16:50:03Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Hugo\_Tadashi](https://meta.discourse.org/u/Hugo_Tadashi)
#### Post date: [February 19, 2021, 4:50pm UTC](https://meta.discourse.org/t/what-scope-is-needed-for-acessing-localhost-posts-json/180358/1 "2021-02-19T16:50:03Z")
Hi,
I generated an admin-issued API key with `write`, `read` and `read lists` scopes. However, when I try to consume the key (adding the key on the header `Api-Key`) to access the `{{localhost}}/posts.json` endpoint, I get the following error:
```plaintext
"errors": [
"You are not permitted to view the requested resource. The API username or key is invalid."
],
"error_type": "invalid_access"
}
```
On the other hand, generating a global key give me access to the endpoint. What is the correct (minimum) scope for reading `{{localhost}}/posts.json`?
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [February 19, 2021, 7:32pm UTC](https://meta.discourse.org/t/what-scope-is-needed-for-acessing-localhost-posts-json/180358/2 "2021-02-19T19:32:50Z")
> [@Hugo\_Tadashi](#):
>
> What is the correct (minimum) scope for reading `{{localhost}}/posts.json` ?
I haven’t tested this yet, but I think that what you are seeing is the expected behaviour. You can click on the anchor button that is displayed next to each of the API key scopes to see which paths the scope allows you to access. You’ll see that the `read` scope is only applied to routes beginning with `/t`. The `read lists` scope gives you access to the Discourse topic lists. There isn’t a scope that specifically allows you to access `/posts.json`, so it looks like you’ll have to use a global key for that.
I’m wondering if it would make sense to add `/posts.json` to the `read` scope.
---
### Author:  [@Hugo\_Tadashi](https://meta.discourse.org/u/Hugo_Tadashi)
#### Post date: [February 19, 2021, 9:19pm UTC](https://meta.discourse.org/t/what-scope-is-needed-for-acessing-localhost-posts-json/180358/3 "2021-02-19T21:19:37Z")
Hi Simon! Thanks for the reply and the explanation. For my use case I’ll need reading the posts from `/posts.json`, but at the same time I would like to be as less intrusive as possible and only ask for read-only access. Is there any workaround?
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [February 19, 2021, 9:49pm UTC](https://meta.discourse.org/t/what-scope-is-needed-for-acessing-localhost-posts-json/180358/4 "2021-02-19T21:49:26Z")
> [@Hugo\_Tadashi](#):
>
> Is there any workaround?
If you are only querying for public posts, you might be able to make an unauthenticated API request to `/posts.json`. If your site is private, or the posts are in protected categories, I think the only way you can currently retrieve the posts is with a global API key.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [February 19, 2021, 10:18pm UTC](https://meta.discourse.org/t/what-scope-is-needed-for-acessing-localhost-posts-json/180358/5 "2021-02-19T22:18:42Z")
#pr-welcome for either a new scope or adding this to `read`, I think.