> ## Documentation Index > Fetch the complete documentation index at: https://docs.casa-layer.com/llms.txt > Use this file to discover all available pages before exploring further. # Update partner credential scopes > Replaces the credential scopes. Scopes must be a non-empty subset of the public read allowlist. Casa updates the issuer application first, then the grant row. **Session auth only.** ## OpenAPI ````yaml /api-reference/openapi.yaml patch /v1/m2m-credentials/{id} openapi: 3.1.0 info: title: Casa API version: 1.0.0 description: > Headless, read-only access to the guest context layer — the entire canonical data model over HTTP. Every endpoint is **scoped by the credential**: the default scope is the caller's property group, returning data across all of its properties. Auth sources resolve to the same credential: a user-generated **API key** (`casa_…`, created in Account settings — the recommended method for first-party machines), a **partner credential** access token (third-party agents, REST-only), a session JWT (the web app; org and role come from verified token claims), or a static token. (The MCP server also accepts read-only OAuth connector tokens, but those are rejected on these REST routes.) Send `X-Property-Id` to drill down into a single property; API keys can also be pinned to one property at creation. Partner credentials reject that header. Tenant isolation holds by construction. Integration-management endpoints write connection *metadata* only and are session-only; canonical guest data enters exclusively through the connector workers and the ingest pipeline. The Model Context Protocol (MCP) server is exposed separately at `/mcp` and is documented under **MCP Server** in the guides — it is not a REST endpoint and is intentionally omitted from this reference. It accepts the same API keys. servers: - url: https://api.casa-layer.com description: Production Cloudflare Worker security: - bearerAuth: [] tags: - name: System description: Liveness, health, and the public welcome page. - name: Guests description: Canonical guest profiles as ingested from each source system. - name: Master Profiles description: >- Identity-resolved golden records — one entity per real guest, merged across sources and properties. - name: Reservations description: >- Reservation records linked to guest profiles, searchable by status, stay window, and channel. - name: Transactions description: >- Revenue lines (Pace Transactions V2–shaped) linked to guests and optionally reservations. - name: Consents description: > Contact-grain consent observations (contact method + value × purpose). Rows store decisive signals only (granted/withdrawn/denied); absence of a row means unknown / not eligible. Effective eligibility within a property group is the most restrictive status among stored observations for the same contact×purpose (withdrawn/denied beat granted). - name: Tables description: > Attio-style ops tables — curated or filter-defined containers for day-to-day work inside Casa. Tables are not consent eligibility records and not marketing segments; campaign audiences stay in downstream ESP tools (Klaviyo, Mailchimp, and peers). - name: Actions description: Guest actions (purchases, visits, and other tracked events). - name: Events description: >- The append-only guest event log — full change history or latest delta slice per entity. - name: Reviews description: Guest reviews with free-text search and an aggregate summary. - name: Loyalty description: Loyalty programs and member search (tier, points, guest). - name: Dimensions description: Reference dimensions — booking channels and bookable spaces. - name: Properties description: >- Properties within a group, plus self-serve onboarding (org-anchored tenant bootstrap). - name: SQL description: >- Read-only SQL over the public data model, isolated per tenant by row-level security. - name: API Keys description: Manage the organization's API keys (session-only). - name: Partner credentials description: Manage the organization's partner credentials (session-only). - name: Integrations description: >- Connection metadata for source systems (Mews, Square, …). Metadata only — never canonical guest data. Session-only. paths: /v1/m2m-credentials/{id}: patch: tags: - Partner credentials summary: Update partner credential scopes description: > Replaces the credential scopes. Scopes must be a non-empty subset of the public read allowlist. Casa updates the issuer application first, then the grant row. **Session auth only.** parameters: - $ref: '#/components/parameters/PathId' - $ref: '#/components/parameters/OrganizationHeader' requestBody: required: true content: application/json: schema: type: object required: - scopes properties: scopes: type: array items: type: string example: - read:guests - read:reservations responses: '200': description: Updated credential. content: application/json: schema: type: object required: - data properties: data: $ref: '#/components/schemas/PartnerCredential' '400': description: Empty scopes or a scope outside the allowlist (`invalid_scopes`). content: application/json: schema: $ref: '#/components/schemas/Error' '401': $ref: '#/components/responses/Unauthorized' '403': description: The credential is not a user session (`session_required`). content: application/json: schema: $ref: '#/components/schemas/Error' '404': $ref: '#/components/responses/NotFound' '502': description: The issuer rejected the scope update (`workos_error`). content: application/json: schema: $ref: '#/components/schemas/Error' components: parameters: PathId: name: id in: path required: true description: Resource id (UUID). schema: type: string format: uuid OrganizationHeader: name: X-Organization-Id in: header required: false description: > Active organization (property group). Optional cross-check for session (JWT) auth: when sent it must equal the token's verified `org_id` claim, else `403`. The org is taken from the claim, not this header. Ignored for API keys, partner credentials, and static tokens. schema: type: string schemas: PartnerCredential: type: object description: > An org-scoped partner credential. Casa never returns or stores the plaintext client secret after create or rotate. required: - id - property_group_id - organization_id - workos_application_id - client_id - name - scopes - created_by - created_at properties: id: type: string format: uuid property_group_id: type: string format: uuid organization_id: type: string workos_application_id: type: string description: Issuer application id. client_id: type: string name: type: string description: type: - string - 'null' scopes: type: array items: type: string created_by: type: string description: Session user id of the creator. created_by_name: type: - string - 'null' description: Display name of the creator from the organization directory. created_at: type: string format: date-time last_used_at: type: - string - 'null' format: date-time description: Latest issuer secret last-used stamp. Null when never used. revoked_at: type: - string - 'null' format: date-time secret_hint: type: - string - 'null' description: Secret hint from the issuer. Not persisted. Error: type: object required: - error properties: error: type: string description: Machine-readable error code. scope: type: string description: The scope that was required when the error is a scope failure.: null detail: type: string description: Optional human-readable detail. responses: Unauthorized: description: Missing, unknown, or revoked bearer credential. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: unauthorized NotFound: description: Resource not found within the credential's scope. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: not_found securitySchemes: bearerAuth: type: http scheme: bearer description: > `Authorization: Bearer `. Token types resolve to the same scoped credential: a user-generated **API key** (`casa_…`, from Account settings — recommended for first-party machines and MCP clients), a **partner credential** access token (third-party agents; REST-only), a session JWT (the web app; org and role come from verified token claims), or a static token. API keys are group-scoped, optionally pinned to one property at creation. Partner credentials reject `X-Property-Id`. MCP OAuth connector tokens authenticate the MCP server only and are rejected on these REST routes. ````