# Permissions and availability

Source: https://neondeerdata.com/docs/api/permissions/

Choose the apps, actions, and resources a connection can access.

## App access and API access

Duplicate Detection, Automations, and Email Notifications are public apps. Their API and MCP availability is a separate choice. The lookup-table API is generally available on Paid and during an active trial; MCP and the other documented API families require an alpha invitation for your organization.

An invitation does not grant a connection every action. Its permissions and selected resources still apply. A missing action or a refused request can reflect the organization's access, the plan, or the connection's permissions.

## Choose permissions by task

| Area                | Choose access for                                                                                                                                                     |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Lookup tables       | Reading rows, writing rows, reading settings, and changing settings. Table and field selections also apply.                                                           |
| Duplicate Detection | Reading results, scanning, requesting AI assessments, proposing plans, merging, recovery, configuration, and ownership as offered. Choose People, Companies, or both. |
| Scheduled runs      | Reading workflows and runs, scheduling, moving or canceling runs, configuration, and transferring ownership. Choose the workflows it may use.                         |
| Automations         | Reading or changing task setup and reported workflow failures.                                                                                                        |
| Email Notifications | Reading delivery settings and activity, or changing permitted settings and canceling waiting alerts.                                                                  |
| Webhooks            | Reading endpoints and deliveries, or changing endpoints and sending permitted deliveries.                                                                             |
| Organization        | Reading setup, changing the organization profile, changing usage sharing, and reading or changing the connected person's own notification preferences.                |

Every endpoint lists its exact API scope names. A request that names several scopes needs all of them. Resource access can narrow those permissions further.

## Writes that need a separate decision

Granting write access is consequential. A lookup-row update replaces stored values; a scheduled run starts a real Attio workflow; a merge combines CRM records. MCP action descriptions identify these effects, but an AI client's confirmation behavior does not replace server-side permissions.

Permitted configuration changes apply with the required access and the current resource version. They do not create a separate portal approval request. Backup settings and permission to merge through the API or an AI app are managed in Neon Deer.

Preparing a merge plan does not execute it. Execution needs the organization's merge setting and the connection's whole-record merge permission, and must match the prepared plan revision. If that access is not allowed, someone runs the plan in Neon Deer. See [merge plans](https://neondeerdata.com/docs/api/duplicate-detection/merge-plans/).

## Versions and ownership

Resource versions prevent an old read from overwriting a newer change. Read again after a conflict, review the new state, and retry with its version only if you still want that change.

API-created scheduled batches and webhook endpoints have controlling connections. Another key does not automatically gain control by receiving the same scope. Follow the documented ownership-transfer operation and check the receiving key's access.

## Personal preferences

Notification-preference routes refer to the person who connected an AI app. A standalone API key has no such person and cannot use those routes. Other organization settings affect the whole organization; changing its time zone can retime recurring duplicate scans.