Sume API key with actions:read only: list schedules, not start runs

Yes, a key with only actions:read can list schedules, read one, and read its runs, but it cannot start or cancel a run. The Sume docs give actions:read for "List and read Actions, read and list runs" and actions:write for "Create a run, cancel a run". Use the read-only key for dashboards and monitors, and keep the write key on the one service that triggers runs.

The scope split

Starting a run needs three things together: the schedule is active, api_trigger_enabled is true, and the key has both actions:read and actions:write. A key lacking a scope fails with 403 insufficient_scope.

Old keys and service accounts

Keys created before the API-call trigger shipped do not carry these scopes. You cannot add scopes to an existing key, so the fix is to create a new key in the dashboard and rotate to it. See Authentication for how keys are sent.

Service-account keys cannot create schedule runs at all. They fail with 403 insufficient_scope and a details.reason of service_account_action_runs_unsupported. If you see that reason, switching to another service-account key will not help; the run has to be started by a regular key.

A split that limits damage

If the monitor key leaks, an attacker can read run receipts but cannot start work. A leaked write key can start runs. Each run has a generation cap, 1.00 dollar by default, but a caller can send generation_spend_cap_usd as null to run without that ceiling, and then only wallet balance, generation admission and org limits apply. Treat the write key as spending authority.

• Monitoring dashboard: a read-only key that lists schedules and reads receipts.
• Trigger service: a write key stored in its secret manager.
• Both keys: kept out of logs, per the safe-automation list of unsafe log content.

Reading a run safely

With the read key, poll GET /v1/action-runs/{run_id}/status for a trimmed payload, and read the full receipt only once it is terminal. Log the request_id from the receipt, which the docs ask you to record, and avoid logging signed media URLs from the artifacts list.