# Key scope

## Project restriction

The Project field limits an API key to a specific project:

* **Any**—the key has access to all projects in the account
* **A specific project**—the key works only with the selected project's data

The restriction behaves differently depending on the method. In listing methods it is a filter: the response is successful but contains only the project's data. In methods that address a specific invoice or wallet, a request for another project's object is rejected with `Restricted project`.

| Method                 | Key restricted to a project                                                 |
| ---------------------- | --------------------------------------------------------------------------- |
| `billing/balances`     | Account-level data; the restriction does not apply                          |
| `billing/history`      | The project's operations plus account-level operations—top-ups and bonuses |
| `billing/tariffs`      | Fee rate and turnover only for the key's project                            |
| `invoices/list`        | Results only for the key's project                                          |
| `payments/list`        | Results only for the key's project                                          |
| `statistics/invoices`  | Calculated only for the key's project                                       |
| `statistics/payments`  | Calculated only on the key's project invoices                               |
| `invoices/create`      | `projectId` in the request must match the key's project                     |
| `invoices/cancel`      | Another project's invoice is inaccessible                                   |
| `invoices/bindPayment` | Another project's invoice is inaccessible                                   |

## Scope restriction

The scope defines which API methods the key can use. It is a required, multi-select field.

A call to a method outside the key's scope is rejected with `Restricted scope`.

## Combining restrictions

The project and scope restrictions work together. For example, if a key is limited to invoice methods and tied to a specific project, then:

* Only invoice methods are available
* Data is filtered to the specified project only
* Requests for payments or statistics are rejected
* Requests for other projects' data are rejected