# API Permission and Capability Check (2026-02-20)

## Scope
- Project: WepAppOpusApi
- Environment checked: production server `192.166.82.95`
- Token source: server env (`/opt/lnwads/WepAppOpusApi/.env`)
- Token value in this report: masked

## Permissions (Graph API `/v19.0/me/permissions`)
Granted:
- ads_management
- ads_read
- pages_read_engagement
- pages_show_list
- public_profile
- user_events

Not granted:
- none

## Runtime probes (live checks)
All checks executed on 2026-02-20.

1) Identity
- Endpoint: `GET /v19.0/me?fields=id,name`
- Result: HTTP 200

2) Ad accounts access
- Endpoint: `GET /v19.0/me/adaccounts?fields=id,name,account_status,currency`
- Result: HTTP 200
- Accounts found: 2
  - `act_2807991909289645` - "ห้างหุ้นส่วนจำกัดน้ำน่าน"
  - `act_674507496655050` - "ณรงค์ รัตนะ"

3) Campaign read access
- Endpoint: `GET /v19.0/act_2807991909289645/campaigns?fields=id,name,status,effective_status`
- Result: HTTP 200

4) Write capability (safe validation only)
- Endpoint: `POST /v19.0/act_2807991909289645/campaigns`
- Mode: `execution_options=["validate_only"]` (no real object created)
- Result: HTTP 200, response `{ "success": true }`

## Conclusion
- This token has real read + write ads capability.
- Budget update operations are feasible from permissions perspective.
- Current app routes are still read/report focused; budget control routes must be added in app code.

## Current app endpoints (WepAppOpusApi)
From `src/index.ts`:
- GET `/health`
- GET `/ready`
- GET `/metrics`
- GET `/metrics/json`
- GET `/bridge/status`
- GET `/live/accounts`
- POST `/live/accounts`
- POST `/live/dashboard`
- GET `/demo/live-dashboard`

## Recommended next implementation
Add write endpoints with guardrails:
- POST `/live/budget/update` (single adset/campaign)
- POST `/live/budget/bulk-update` (batch)
- POST `/live/campaign/status` (pause/resume)

Safety controls:
- dry-run mode (default true)
- max change limit per request (example +/-20%)
- account allowlist
- audit log table (`who`, `when`, `before`, `after`, `reason`)
- idempotency key