Skip to main content
Read access and write access to the REST API are separate entitlements. An API key that reads your whole portfolio cannot create a property until write access is turned on for the account.
This page is about the REST API. The MCP server is read-only apart from custom terms and saved portfolio reports, and those two do not require the write module — they need only the matching write capability.

Two gates, both of which must pass

Every POST, PATCH, and DELETE in the API reference is checked twice:
1

The account must have the REST API write module enabled

A per-account entitlement. It is checked before anything else, and it is not something you can grant yourself.
2

The key must carry the write capability for that resource

The ordinary capabilities model — write on property, building, building space, lease, document, tag, or custom tag, depending on the endpoint. Each endpoint page states which it needs.
Both failures return 403. If reads work and writes return 403 across the board — every resource, every endpoint — the module is the thing to check first. If only some writes fail, it’s the capability, and the message names which one is missing.

Getting the module turned on

The REST API write module is not self-service. A Prophia employee has to enable it on your account, and because it is a paid add-on rather than a default, that starts as a commercial conversation.
To enable write access, talk to your Prophia account manager or the sales team. Support cannot flip it on request — it is negotiated as part of your agreement, then enabled by Prophia.
Two details worth knowing when you ask:
  • Write depends on read. The write module only takes effect on an account that already has the REST API module enabled. Both are needed.
  • It is explicitly opt-in. Unlike most modules, write access is never granted implicitly by a broader “all access” entitlement on the account. It is always a deliberate, separate switch.