Permissions & Limits

This page covers how access control, rate limiting, and error handling work for the Zenovay MCP integration.

OAuth Scopes

When you authorize an MCP client, you choose permission levels for each tool category. These are represented as OAuth scopes in the format {category}:{level}.

Permission Levels

Available Scopes

Shorthand scopes:

• read — All categories at read level
• write — All categories at write level (includes read)

Write-Protected Tools

The following tools require Write permission for their category. If you authorized with Read-only access, these tools return error code -32007:

Management (Write)

create_goal, update_goal, delete_goal, toggle_goal, manage_funnel, delete_funnel, update_website_settings, toggle_public_dashboard, toggle_cookieless_tracking, regenerate_tracking_code, update_website_name, update_website_timezone, update_website_domain, pause_tracking, resume_tracking, schedule_report, cancel_report, create_api_key, delete_api_key, update_api_key_settings

Settings (Write)

add_ip_exclusion, remove_ip_exclusion, add_path_exclusion, remove_path_exclusion, update_notification_settings, invite_team_member, remove_team_member, set_revenue_currency, add_allowed_domain, remove_allowed_domain, request_data_deletion

Advanced (Write)

create_uptime_check, delete_uptime_check

Webhooks (Write)

create_webhook, delete_webhook, test_webhook

All other tools work with Read access.

Changing Permissions

To change the permissions granted to an MCP client:

1. Revoke the existing token — In Settings > Usage, find the connected application and revoke it
2. Re-authorize — Your MCP client will prompt for authorization again
3. Select new permissions — Choose different Read/Write levels on the consent page

Plan-Gated Features

Certain tools are tied to features that require specific subscription plans:

Calling a plan-gated tool on an unsupported plan returns error code -32002.

Data Retention Limits

Analytics queries are automatically clamped to your plan's data retention window:

Rate Limits

Daily Query Limit

Each team has a daily MCP query budget. All connected applications share the same quota.

Usage resets at 00:00 UTC every day.

Query Cost

Checking Usage

Use the get_api_usage tool or check Settings > Usage in the dashboard:

{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
  "name": "get_api_usage",
  "arguments": {}
}
}

Error Codes

Standard JSON-RPC Errors

Zenovay MCP Errors

Error Response Format

{
"jsonrpc": "2.0",
"id": 1,
"error": {
  "code": -32007,
  "message": "Tool 'create_goal' requires write permission for the 'management' category. Re-authorize with management:write scope."
}
}

Security

OAuth 2.1 provides several security advantages over API keys:

1. No secrets to manage — Tokens are issued automatically, no key to copy/paste
2. Granular scopes — Grant only the permissions each client needs
3. Token expiration — Access tokens expire after 1 hour and refresh automatically
4. Instant revocation — Revoke a client's access immediately from the dashboard
5. PKCE protection — Authorization codes can't be intercepted
6. Audit trail — See which clients are connected and when they last made requests