Not in the API

Some things only happen in the app, on purpose:

• Creating API keys — a key can never mint keys, nor change the limits it buys numbers under.
• Deleting the workspace, moving ownership, releasing or removing phone numbers, connecting channels, inboxes, LinkedIn seats, data providers or integrations — they need a browser sign-in, can't be undone, or would let a key keep itself alive. Buying numbers is in the API, under its own rules (Buying phone numbers).
• Making ads of any kind — writing ad copy, generating images or videos, searching reference ads, looking up interests or creating audiences. Nora makes the ads, in a plan (POST /briefs).
• Choosing ad pixels, for ads or landing pages.
• Switching campaigns on ad networks other than Meta on or off, and those networks' spending limits — do it in the network's own ads manager. Switching back on a campaign made outside NorReach is done in the ad network too: there is no plan cap to hold it to. (Meta campaigns: POST /ad-campaigns/{id}/pause and /resume; Meta spending limits: PUT /ad-accounts/{id}/spending-limit.)
• Publishing a voice agent to the AI caller, changing a published agent's voice or tools, and cloning voices. The API creates and changes agents (name, language, first message, script, voice, number).
• Business verification documents larger than about 3 MB together, and US business texting registration.
• AI-written social posts and templates — drafting posts from a link, captions, hashtags, post ideas or a template with AI. Nora writes in the plan (POST /briefs); the API takes your own words.
• Connecting or removing social profiles — that needs the network's own sign-in, in the app.
• Nora acting on a question — POST /nora/ask only answers and shows. Work goes to a task (POST /nora/runs), and every step of it that sends, calls or publishes waits in Approvals. A task can't make, find or publish ads (Nora makes ads inside a plan).
• Buying credits, billing, or changing what actions cost.
• Making anyone an owner and removing people from the workspace — the API changes roles up to your own and switches people off (PATCH /members/{id}).

Actions with no scope: workspace.delete, numbers.release, channels.connect, mailboxes.connect, providers.manage, integrations.manage, linkedin.seats.