API Key Path Restrictions

An API key's path restriction limits direct file and folder requests to a folder and its subfolders. On a Full Access key, it does not confine everything the integration can do to that folder. Administrators choosing credentials for a folder-limited integration should use Files Only together with a path restriction.

Full Access and Automations

Full Access preserves the management capabilities available to the key. Adding a path restriction does not remove permission to create or manage Automations when the key otherwise has that permission.

An Automation runs with its own permissions, not the path restriction of the API key used to configure it. An integration whose Full Access key can manage Automations can therefore arrange file operations outside the key's restricted path, even though direct file requests to those locations are refused. The Automation must still have permission to access the files it uses. Automation Ownership and Permissions (v1) and Ownership and Permissions (v2) explain which permissions apply to a workflow.

This separation is intentional. The path restriction narrows direct file access, while Full Access keeps management functions available. Do not rely on a path restriction to contain the effects of a Full Access key.

Choosing Access for a Folder-Limited Integration

Use a Files Only key with its path set to the folder the integration needs. Files Only removes administrative capabilities, including managing Automations, so the integration cannot use those capabilities to arrange file operations elsewhere. The path restriction then limits its direct file and folder requests, including both the source and destination of a copy or move.

Whenever possible, associate the key with a dedicated non-administrator user whose folder permissions cover only the required work. Choose the appropriate Workspace as well. These controls limit the authority available to the integration independently of the key's path setting.

If an integration needs Full Access to manage workflows or other settings, evaluate the user permissions and Workspace scope that give it that access. A path restriction alone does not make that key suitable for an integration that must stay within one folder. API Keys covers configuration and the response to a refused file request.