Scope your Epicor API access

Epicor lets you restrict an API key, and the service account behind it, to specific business object services and methods. Scoping the key this way limits Cutova to exactly what your published tools need and nothing more. It is optional hardening that a security review appreciates.

You set this in Epicor, on the API key, not in Cutova. Every Cutova tool call runs as the signed-in Epicor user through impersonation, so a person can never exceed their own Epicor permissions. Scoping the key adds a second, narrower ceiling on top of that.

What the scope must include

Always include these. Cutova uses them for registration, for setup, and for browsing the BAQs you can turn into tools, so leaving them out breaks registration or tool creation:

• Ice.BO.BaqDesignerSvc, methods GetList and GetByID. These generate and select the available BAQs when you create a BAQ tool.
• Ice.Lib.SessionModSvc, method GetPatchLevelApp. This reads your Epicor version.
• The whole MCP Function library, the one the Cutova solution installs. It contains RegisterTenant, which Cutova calls with this same API key when you register the instance and again whenever you re-register, so a key scoped without the MCP library fails at registration.

Then add the specific operations your own tools use:

• The BAQs you publish as tools.
• The Epicor Functions (function library and function) you publish as tools.
• The Business Object services and methods you publish as tools, for example Erp.BO.CustomerSvc with GetList.

Keep the scope in step with your tools

Every time you publish a tool over a BAQ, Business Object or Function the scope does not yet cover, add that exact item to the scope in Epicor and keep the two in sync. For example:

• Publish a BAQ tool for BAQ id zCustomer01: add zCustomer01 to the scope.
• Publish a Business Object tool over Erp.AbcCodeSvc: add Erp.AbcCodeSvc to the scope.
• Publish a Function tool from library MCPTools: add MCPTools to the scope.

Skip this and the tool fails with a permissions error the first time the assistant calls it.

This is optional hardening

If you do not scope the API key, Cutova still runs every call as the signed-in Epicor user, so nobody can exceed their own Epicor permissions. Scoping the key is defense in depth, not a requirement to get started.