# Scope: what a key can see

Source: https://help.ruuster.com/api/scope

> What a key can see: the whole brokerage, the listings attributed to it, and lead contact details (on unless you ask for them off).

Only owner and admin keys can use the API, and every one of them sees the whole brokerage: every
agent, every lead, and every listing attributed to the brokerage. There's no agent-level access, and
agents appear only as a directory, with no activity figures.

- Listings are attributed to your brokerage when the listing agent's MLS id is on one of your
  agents' Ruuster profiles. Listings from an MLS office count too, but only offices Ruuster has
  confirmed belong to your brokerage. `matchSource` on each listing says which applied, and
  `attribution` in `/me` shows how many of your agents have MLS ids on file. If listings are missing,
  ask your CSM to add your agents' MLS ids.
- **Any listing, one at a time; your own leads only; bulk means your inventory.** Events, the event
  feed and a lead's activity name every listing a lead engaged with (MLS number, MLS, address,
  `ownedByYou`), and `GET /properties/{propertyId}` returns any listing's details and photos by id.
  `GET /properties/lookup` resolves an MLS number to any listing in your MLSs, at the lookup limit of
  20 per minute. A listing's viewers and its `scope=any` engagement are always your own leads, never
  another brokerage's audience. Every call that returns many listings (`/properties`,
  `/properties/engagement`) covers listings attributed to your brokerage only; nothing lists or ranks
  listings across an MLS.
- Site traffic (`/traffic`) is measured per website.
- Anything that isn't your brokerage's returns `404 not_found`, the same as something that doesn't
  exist.
- Data never crosses brokerages. When a listing you own is viewed on another brokerage's Ruuster
  site, the view counts in your listing totals, but you never see who the other brokerage's visitor
  was.

**Lead contact details.** Lead email addresses and phone numbers are on by default for every
brokerage. If you'd rather not receive them, ask your Ruuster CSM to turn them off. `/me` shows the
setting as `leadContactDetails`. When it's off, every lead object omits `email` and `phone`; everything
else works, including lookup by email or phone.