📢 New: Shaping the future of API Standards with the OpenAPI Initiative. Read more →

Early Access

Data ScopesField-Level Control

Request only the data you need. Minimize exposure, maximize compliance, and improve performance across all your integrations.

WITHOUT DATA SCOPES

{"id": "emp_123",
"first_name": "Jane",
"last_name": "Doe",
"email": "jane@company.com",
"ssn": "***-**-1234",
"salary": 125000,
// ... 41 more fields
}

WITH DATA SCOPES

{"id": "emp_123",
"first_name": "Jane",
"last_name": "Doe",
"email": "jane@company.com"
}

Transparent consent that builds trust

Your users see exactly what data your application needs. With Vault's built-in consent screen, requesting field-level permissions becomes a seamless part of the integration flow.

Clear permission requests
Users understand exactly what data they're sharing
Granular control
Show read vs. write access for each field
No development needed
Consent UI is automatically generated from your data scopes

Developer guides Learn about Vault

Requested Data Access

The application is requesting permission to access the following data.

display_name

ReadWrite

company_name

ReadWrite

Read

notes

Read

By authorizing you agree to grant the application access to the data listed above.

When APIs return more than you need

Without Data Scopes

With Data Scopes

50+ fields returned when you only need 3-5

Request exactly the fields you need

Sensitive data (SSN, salary) exposed unnecessarily

Sensitive data never reaches your app

Larger payloads impact performance

Smaller payloads, faster responses

No standardized filtering across APIs

Consistent filtering across 200+ connectors

Compliance burden for audits

Built-in data minimization for compliance

Benefits of Data Scopes

Field-level filtering gives you complete control over API data access while improving performance and compliance

Privacy by Design

Request only the data your application needs. Support GDPR data minimization requirements out of the box.

Faster Responses

Smaller payloads mean faster response times and reduced bandwidth costs for your application.

Audit Ready

Demonstrate data access controls for SOC 2, HIPAA, and other security compliance audits.

Consumer Control

Let your customers choose exactly what data they share through Vault configuration.

Universal Filtering

Consistent field filtering across 200+ connectors, even when downstream APIs don't support it.

Flexible Levels

Define scopes at application, consumer, or per-request level for maximum control.

For developers

Simple configuration through API or dashboard. Define scopes once, enforce automatically across all requests.

→Declarative scope definitions
→Per-request override capability
→Works with existing SDKs

For compliance teams

Demonstrate data minimization practices with clear audit trails showing exactly what data your application accesses.

→GDPR data minimization support
→SOC 2 access control evidence
→Centralized policy management

The data you need, nothing more

Data Scopes filter API responses before they reach your application, returning only the fields you specify.

Without Data Scopes

47 fields

{  "id": "emp_123",
  "first_name": "Jane",
  "last_name": "Doe",
  "email": "jane@company.com",
  "ssn": "***-**-1234",
  "salary": 125000,
  "bank_account": "****4567",
  "home_address": "123 Main St",
  "phone_number": "+1-555-0123",
  "date_of_birth": "1990-05-15",
  "hire_date": "2021-03-01",
  "department_id": "dept_456"
  // ... 35 more fields
}

● Sensitive fields like SSN, salary exposed

With Data Scopes

4 fields

{  "id": "emp_123",
  "first_name": "Jane",
  "last_name": "Doe",
  "email": "jane@company.com"
}

● Only the fields you need

47 fields4 fields91% reduction

Early Access

Now available for HRIS & Accounting

Data Scopes are currently available for the HRIS and Accounting API, with more Unified APIs coming soon.

HRIS

Sync employee directories without accessing salary, SSN, or banking details

idfirst_namelast_nameemaildepartment

Accounting

Access invoice totals and status without exposing full customer PII

idtotaldue_datestatusinvoice_number

More APIs coming soon

CRM, ATS, and more Unified APIs will support Data Scopes soon.

Real-time, secure data

Our security approach focuses on security governance, risk management and compliance.

Zero Data Retention

We do not store your data. API calls are processed in real-time and passed directly from the source to your app.

SOC2 Certified

Our security framework maintains the highest level of compliance with industry standards.

No data storage: Apideck does not store your customer data, providing you with high-level data loss protection.
Real-time data: Because Apideck does not cache your information, you get instant up-to-date information without waiting for syncs.
Usage-based billing: Our usage-based billing model provides you with full control on your spend.
Enterprise level reliability: Built for enterprise workloads with guaranteed uptime and robust infrastructure.