> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sportrix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sportrix Data API Scopes and Permissions Reference

> Sportrix Data uses scopes to control which endpoints your API key can access. Learn which scope grants access to fixtures, live scores, and results.

Every Sportrix Data API key inherits a set of **scopes** from your account. Scopes are the permission layer that controls which endpoints you can call. If you request an endpoint your key is not scoped for, the API returns `403 Forbidden`. Understanding which scope you need before you build saves debugging time later.

## Scopes reference

| Scope                    | Grants access to                                                                                                               |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------ |
| `fixtures`               | `GET /sports`, `GET /leagues`, `GET /leagues/active`, `GET /teams`, `GET /matches`, `GET /matches/active`, `GET /matches/{id}` |
| `live_scores`            | `GET /matches/{id}/live`                                                                                                       |
| `live_scores_statistics` | Real-time WebSocket stream **and** `GET /matches/{id}/live`                                                                    |
| `final_scores`           | `GET /matches/{id}/result`                                                                                                     |

<Note>
  `GET /matches/{id}/live` accepts **either** `live_scores` **or** `live_scores_statistics` — you only need one of them to call that endpoint.
</Note>

<Note>
  The **WebSocket stream** requires `live_scores_statistics` specifically. The `live_scores` scope alone is **not** sufficient to open a WebSocket connection.
</Note>

## Sport allowlist

In addition to scopes, your account is configured with a set of **enabled sports**. Access is deny-by-default: you only ever see sports, leagues, and matches for your enabled sports.

Requesting data outside your allowlist is **not treated as an error** by the API:

* `GET /leagues?sport=<disabled sport>` returns an empty `items` array.
* `GET /matches/{id}` for a match in a disabled sport returns `404 Not Found`.

This means your code will not need special handling for allowlist mismatches — you simply receive no data rather than an exception.

## What 403 Forbidden means

A `403 Forbidden` response means your API key exists and is valid, but **lacks the required scope** for the endpoint you called. The response body will identify the missing scope:

```json theme={null}
{ "detail": "Missing required scope: live_scores" }
```

This is distinct from `401 Unauthorized`, which means the key itself was not recognized, is disabled, or has expired.

<Tip>
  To add scopes or enable additional sports on your account, contact [Sportrix Data support](mailto:support@sportrixdata.com). Changes take effect on your next request — no key rotation needed.
</Tip>