### Answer Yes, you can restrict permissions per API key. Enable "Restrict permissions" when creating or editing a key, then assign an access level to each permission group [(1) ]() . Each group supports up to three levels : - **No Access**: the key cannot call any endpoint in this group - **Read**: the key can call read-only endpoints (listing/fetching resources) - **Edit**: the key can call both read and write endpoints (also grants Read) Some groups are action-only and skip the Read tier, offering only No Access or Edit . The permission groups are : - **Build → Agent**: No Access · Read · Edit — agents/chat agents, conversation flows, Retell LLMs, knowledge bases, voices, folders - **Build → Testing**: No Access · Read · Edit — test cases/results, batch test jobs, playground threads/completions, web-call testing - **Monitor → History**: No Access · Read · Edit — call/chat history, transcripts, recordings, metadata - **Monitor → Export**: No Access · Edit — export requests for history data - **Deploy → Call**: No Access · Edit — web, phone, batch calls, chat sessions, live-call controls - **Deploy → Phone**: No Access · Read · Edit — phone numbers, A2P campaigns, business profiles, branded call/phone verification, SMS webhooks Restrictions only apply to requests made with that specific key, and you can edit them anytime; a key created without restrictions keeps full access . By default, without restrictions, a key has full access to every API endpoint that supports API key authentication . Note: each workspace's API keys all share the same permission level by default, though scoping via restrict permissions lets you differentiate a given key's access [(2) ]() .

​ To learn more, see the sources I considered: [[1] Manage API keys and permission scopes](https://docs.retellai.com/accounts/manage-api-keys) [[2] API Key Overview](https://docs.retellai.com/accounts/api-keys-overview) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.