---
title: "Routes and permissions — Anis Developers"
description: "Every call, the permission it needs, how it is authenticated and which limits it counts toward."
url: https://developers.anis.ly/docs/routes-and-permissions/
language: en
---

> Every page of this documentation: https://developers.anis.ly/llms.txt

# Routes and permissions

Anis staff grant your application its permissions. [Read your profile](https://developers.anis.ly/reference/read-profile.md) to see the ones it has right now.

## Every call

| Call | Permission | Authentication | Limits it counts toward |
| --- | --- | --- | --- |
| GET [Read your profile](https://developers.anis.ly/reference/read-profile.md) | `profile:read` | Signed read | All requests |
| GET [List wallets](https://developers.anis.ly/reference/list-wallets.md) | `wallets:read` | Signed read | All requests |
| GET [Read a wallet](https://developers.anis.ly/reference/read-wallet.md) | `wallets:read` | Signed read | All requests |
| GET [List catalogue categories](https://developers.anis.ly/reference/list-categories.md) | `catalogue:read` | Signed read | All requests |
| GET [List subcategories of a category](https://developers.anis.ly/reference/list-subcategories.md) | `catalogue:read` | Signed read | All requests |
| GET [Read a subcategory](https://developers.anis.ly/reference/read-subcategory.md) | `catalogue:read` | Signed read | All requests |
| GET [List cards for sale](https://developers.anis.ly/reference/list-cards.md) | `catalogue:read` | Signed read | All requests |
| POST [Place an order](https://developers.anis.ly/reference/create-order.md) | `orders:create` | Signed order | All requests, Orders |
| GET [Read an order](https://developers.anis.ly/reference/read-order.md) | `orders:read`  or `orders:create` for your own orders | Signed read | All requests |
| GET [List owned cards](https://developers.anis.ly/reference/list-owned-cards.md) | `cards:read` | Signed read | All requests |
| GET [Read an owned card](https://developers.anis.ly/reference/read-owned-card.md) | `cards:read` | Signed read | All requests |
| POST [Reveal a card](https://developers.anis.ly/reference/reveal-card.md) | `cards:reveal` | Signed change | All requests, Reveals |
| POST [Reveal an invoice](https://developers.anis.ly/reference/reveal-invoice.md) | `cards:reveal` | Signed change | All requests, Reveals |
| POST [Check your signature](https://developers.anis.ly/reference/check-signature.md) | `diagnostics:use` | Signed change | All requests |
| GET [Read an invitation](https://developers.anis.ly/reference/read-invitation.md) | None | Enrolment token | None |
| POST [Submit a public key](https://developers.anis.ly/reference/submit-key.md) | None | Enrolment token | None |
| POST [Prove you hold the key](https://developers.anis.ly/reference/submit-proof.md) | None | Enrolment token | None |
| GET [Read enrolment status](https://developers.anis.ly/reference/read-enrollment-status.md) | None | Enrolment token | None |
| GET [Anis’s public signing keys](https://developers.anis.ly/reference/signing-keys.md) | None | Public | None |

The permissions are `profile:read`, `wallets:read`, `catalogue:read`, `orders:create`, `orders:read`, `cards:read`, `cards:reveal` and `diagnostics:use`. `orders:create` also lets you read your **own** orders.

## Before a call is looked at

Anis checks each of these before any business decision, so an order refused by one of them was never placed. The order in which they run is not part of the contract — do not rely on meeting one before another.

| Check | Refusal |
| --- | --- |
| The request’s shape and body, including a body where none is allowed | [`validation_failed`](https://developers.anis.ly/errors/validation-failed.md) |
| The body matches its digest | [`invalid_credentials`](https://developers.anis.ly/errors/invalid-credentials.md) |
| The key exists, is active and signed this request; the signature is fresh | [`invalid_credentials`](https://developers.anis.ly/errors/invalid-credentials.md) |
| The nonce was not seen before | [`replay_detected`](https://developers.anis.ly/errors/replay-detected.md) |
| A staff-set limit, or Anis’s own protection | [`rate_limited`](https://developers.anis.ly/errors/rate-limited.md) |
| The call comes from one of your allowed networks | [`insufficient_scope`](https://developers.anis.ly/errors/insufficient-scope.md) |
| Your application has the route’s permission | [`insufficient_scope`](https://developers.anis.ly/errors/insufficient-scope.md) |
| The wallet in the address is granted to your application | [`wallet_not_granted`](https://developers.anis.ly/errors/wallet-not-granted.md) |

## Paging

The list calls return a page and a `nextCursor`. Pass it back as `cursor` — exactly as received — to get the next page; there is no `nextCursor` on the last one. A changed or malformed cursor is refused as [`validation_failed`](https://developers.anis.ly/errors/validation-failed.md).