Skip to main content
Organization advertiser grants let an advertiser owner authorize another organization to work with specific advertisers. A grant names every advertiser ID and capability, requires the invited organization to accept, and always has an expiry date. This feature is a limited beta and is unavailable unless Scope3 explicitly enrolls the Organization. Every advertiser-grant REST endpoint and every V3 advertiser-grant entry point requires an eligible Organization, an active time-bounded beta entitlement, and server-side beta exposure enabled by Scope3. Delegated roster entries require the same checks, while owned roster entries remain available. Being named in a grant does not bypass those checks. Scope3 enrolls internal teams first, followed by named beta Organizations; there is no pricing or plan change in this release. The advertiser owner keeps ownership and the existing advertiser and Campaign IDs. A grant does not expose account IDs, members, billing, unrelated or future advertisers, or private advertiser configuration. Names, email domains, CRM associations, signup history, providers, external Business Manager membership, and Partner status never create authority.
Grant lifecycle changes require a directly authenticated human organization administrator. Service tokens, advertiser-scoped credentials, impersonated sessions, and inherited child-account sessions cannot invite, accept, reject, or revoke.

​
Get the organization reference

Call GET /api/v2/organization/advertiser-grants. The data.organization.organizationRef value is the exact reference another organization uses to invite you. Share that reference with the advertiser owner through a trusted channel. Display names and domains cannot substitute for it.

​
Invite an organization

POST /api/v2/organization/advertiser-grants
curl
Every grant must include advertiser.read. campaign.manage also requires campaign.read. Campaign management can be granted only when the owner still holds that authority directly. Invitations expire within 365 days and cannot silently expand to advertisers created later. Grant lifecycle changes require a directly authenticated human organization administrator. User API keys and service tokens cannot invite, accept, reject, or revoke organization advertiser grants.
This release records reviewed campaign capabilities and establishes their tenant-safe authorization boundary, but it does not extend the existing Buyer Account Campaign endpoints. Those endpoints remain account-scoped until delegated Campaign projection is released separately.
An existing pending or active grant for the same organizations and advertiser must be rejected, revoked, or expired before a replacement is invited.

​
Respond or revoke

The invited organization accepts or rejects the immutable invitation:
curl
Replace accept with reject to decline. Only the invited organization can record either response. The granting organization can end a pending or active grant immediately:
curl
Grant state is invited, active, rejected, revoked, or expired. Acceptance, rejection, revocation, and observed expiry append to the grant’s history; they do not rewrite earlier events.

​
Read grants and delegated advertisers

  • GET /api/v2/organization/advertiser-grants lists incoming and outgoing grants visible to organization administrators. The response returns at most 500 grants and sets data.page.truncated when more grants exist.
  • GET /api/v2/organization/advertiser-grants/{grantRef} returns one grant and its complete lifecycle history.
  • GET /api/v2/organization/advertisers includes an accepted, unexpired exact advertiser as relationshipClass: "delegated" with the grant reference, owner organization, capabilities, and expiry. It never includes the owner’s backing account ID.
On MCP V3, use save_advertiser_grant for lifecycle changes, search({kind: "advertiser_grant"}) to list grants, and get({kind: "advertiser_grant", id: "..."}) for complete history. A truncated search page returns totalLowerBound, truncated: true, and a nextCursor; only an untruncated page returns the exact total observed through that page. Revoked and expired grants disappear from live roster reads immediately. A stale roster entry or cached grant response is never evidence of current authority. Every delegated operation rechecks the active accepted grant for the exact advertiser and capability. Disabling cohort exposure or removing the beta entitlement from either organization stops access without deleting grant or audit history. This release does not add delegated Campaign operations.

​
Errors

  • 400 VALIDATION_ERROR — an advertiser is not owned by the grantor, a capability combination is invalid, or the expiry is outside the allowed window.
  • 403 ACCESS_DENIED — the caller is not the required direct human administrator, is the wrong party for the transition, lacks the active beta entitlement, does not have server-side beta exposure enabled by Scope3, or does not belong to an eligible Organization.
  • 404 NOT_FOUND — the organization, grant, or live authorized advertiser is not visible to the caller.
  • 409 CONFLICT — the lifecycle state, live ownership, or owner-held campaign authority changed, or an overlapping grant exists.
See Errors for the full error contract.

List organization advertisers

Read owned and actively delegated advertisers

Advertiser overview

Understand advertiser ownership and resources