Authentication and scopes

Every endpoint requires a company API key:

Authorization: Bearer YOUR_API_KEY

API keys are tenant-bound. The API checks that programs, reports, assets, users,
and related objects belong to the company that issued the key. Cross-company
identifiers are returned as 404.

Available scopes

Scope	Allows
`reports:read`	List reports and retrieve report details and comments
`reports:comment`	Add a program-visible report comment
`reports:priority:write`	Change report priority
`reports:rewards:write`	Assign bounties, bonuses, or swag
`reports:status:write`	Change report status
`assets:write`	Create, update, or archive company assets
`company:members:write`	Invite or remove organization members
`hunters:verify`	Verify a hunter token

Keys created before scopes were introduced have reports:read only. Generate a
new key if a write endpoint returns a scope error. Any key containing a write
scope can be issued for at most 90 days.

Use separate keys for separate integrations, grant the minimum scopes required,
and rotate keys immediately if they are exposed.