# Read Endpoints for Platform Data in the Public API
URL: https://docs.autociso.io/release-notes/2026-10-public-api-read-endpoints/
Description: API tokens can now read assets, risks, suppliers, ISO projects, compliance posture, evidence, the access inventory, employees and the Audit Trail with nine read-only scopes.

## Read-only access to platform data

**Plans:** Depends on the feature behind each endpoint; see below
**Where:** **API Tokens**; `/api/v1/...`
**Who benefits:** CTOs, IT managers, BI teams and auditors who want AutoCISO data in their own scripts and dashboards.

The nine read scopes `asset:read`, `risk:read`, `supplier:read`, `iso:read`, `compliance:read`, `evidence:read`, `access_review:read`, `employee:read` and `audit_log:read` are now live for every organisation. Until now a token could hold them, but the endpoints were switched off. The **Not live yet** badge in the create-token dialog is gone for them.

Every endpoint is read-only and has a page in the [API reference](https://docs.autociso.io/api/reference/). Which scope opens which operation, who may grant it and the longest expiry are listed in [Read scopes for platform data](https://docs.autociso.io/developers/access-model/#read-scopes-for-platform-data).

**Things to know**

- **Plans still apply.** A scope never unlocks a feature your plan lacks. The call returns `402` with the code `FEATURE_GATED`, and `error.args.minTierName` names the lowest plan that includes it.
- **Employee names and emails need `pii:read`.** `employee:read` returns employee records without identity values. A token that also holds `pii:read` receives names and emails, within a personal-data limit per token and hour. See [Employee identity](https://docs.autociso.io/developers/employee-identity/) for the limit.
- **Reads are audited.** Listing the Audit Trail, and any read that returns employee identity, is recorded in your Audit Trail.
- **Owner-only scopes.** `access_review:read`, `employee:read` and `audit_log:read` can be granted only by an Owner.

**How to use it**

1. Click the user menu, then **API Tokens** and **Create Token**. Tick the scopes you need and choose an expiry within the longest allowed for them.
2. Call an operation, for example [List suppliers](https://docs.autociso.io/api/reference/suppliers/list/), with `Authorization: Bearer <token>`.
3. Page through a list by passing `meta.nextCursor` of the previous page as `cursor`.