> ## Documentation Index
> Fetch the complete documentation index at: https://developers.luccasoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Control

When retrieving events via `GET /lucca-api/events`, the results are filtered based on the caller's
permissions. Not all events are visible to all consumers.

#### OAuth scope-based topic filtering

When an OAuth client calls the events endpoint, it will only receive events whose topic matches one
of its granted OAuth scopes. Each resource scope grants access to all event topics for that resource.

For example, a client with the `employees.readonly` scope will see:

* `employee.created`
* `employee.updated`
* `employee.deleted`

Both the `.readonly` and `.readwrite` variants of a resource scope grant the same read access to events.
In other words, holding `employees.readwrite` gives access to the same event topics as `employees.readonly`.

<Note>The `events.readonly` scope is required to call the events endpoint, but it does not by itself determine
which topics are visible. The visible topics are determined by the resource scopes granted to your OAuth client.</Note>

#### Establishment-level filtering

Like most resources, Events are also filtered by the caller's permitted business establishments. You will only see events
that occurred within establishments your credentials have access to.

<Note>Some resources are not linked to a particular business establishment, like Departments. If you have `events.readonly`
and `departments.*` scopes, you'll see events for all departments.</Note>

#### Section-level filtering (employee-attribute events)

Events with `employee-attribute.*` topics are additionally filtered by the **HR file sections** granted to
your OAuth client. You will only see employee-attribute events for attributes that belong to a section your
client has been explicitly given access to.

<Note>This is the same section-based access control that applies when reading employee attributes directly.
See the [employee-attributes guide](../employee-attributes/get-started#granting-access-to-hr-file-sections) for
how to configure section access on your OAuth client.</Note>


## Related topics

- [API Guidelines](/documentation/guidelines.md)
- [Create Access-Token](/api-reference/latest/create-access-token.md)
- [Get Started](/api-reference/latest/files/get-started.md)
- [Get Started With Authentication](/documentation/using-api/authentication.md)