Hi all,
We’ve built an AI agent integration for a customer’s ServiceM8 account, connected via Composio (an MCP/OAuth-based integration platform). Most objects work fine (jobs, notes, clients, schedules), but the Attachment endpoint consistently returns 403 insufficient_scope for job photos and file attachments, even after requesting additional scopes through our integration provider’s auth config.
ServiceM8’s own support chat confirmed to our customer that MCP integrations currently can’t add photos or documents, which lines up with what we’re seeing.
We found a similar thread here (jobactivity.json 403 with a “Full Access key”) where Cody confirmed that a real ServiceM8 API key (X-API-Key header) has broader access than an OAuth/MCP connection, and isn’t scope-gated the same way.
Before we rebuild this part of our integration around a direct API key, wanted to confirm:
- Does a ServiceM8 API key (Private Application, X-API-Key header) grant access to the Attachment endpoint (read_job_attachments, publish_job_attachments, read_job_photos, publish_job_photos) without needing any additional scope granted?
- Is access purely tied to the permission level of the staff member who generated the key, or is there anything else (plan tier, account setting) that could restrict it?
Would really appreciate confirmation before we commit to switching this part of the integration over.
Thanks!