# Access and Permissions

Every API key has an explicit authorization scope. The API evaluates that scope on every REST and MCP request.

## Permission Dimensions

### Dataset Access

A key may allow:

- ICD
- ICDB
- Both datasets

Route visibility does not grant access. The key must be authorized for the requested dataset.

### Record Scope

A key may be limited to an approved subset of records or entities. Filters cannot expand that scope.

### Capability Access

A key may independently allow or deny capabilities such as:

- Structured search and detail retrieval
- Media access
- Geo Manifests
- Natural Language Search
- Domain GenAI
- MCP access

### Usage Controls

Accounts may also have credit, quota, and rate-limit controls. A valid key can still receive a usage-related rejection when a control is reached.

## Privacy-Preserving Responses

For some unavailable, missing, or unauthorized records, the API may use a response that does not confirm whether content exists outside the caller's scope. Integrations must not infer broader dataset contents from empty or not-found responses.

## MCP

MCP tools apply the same dataset, record, feature, quota, and credit controls as the equivalent REST routes. Connecting `/mcp-all` does not override the key's permissions.

## Troubleshooting

- **401 Unauthorized:** the key is missing, invalid, or sent incorrectly.
- **403 Forbidden:** the key lacks a required dataset or capability.
- **404 Not Found:** the identifier is unavailable within the request context, or the route is incorrect.
- **429 Too Many Requests:** wait for the indicated interval and apply backoff.

Contact IntelCenter support if the assigned scope does not match the intended integration.