# The /api/public reference says what an organisation key needs for each operation

- Date: 2026-10-29
- Type: New
- Surface: Developer portal and CLI, /api/public
- What you need to do: Nothing.
- Address: https://developers.rivr.io/changelog/2026-10-29-key-capability-per-operation

Every /api/public operation in the API reference now has a line "Organisation key": the capabilities a key needs on the clinic to call it (for example `orders:manage` and `customers:read` to create an order), that any capability will do, that the route needs no token, or that a key can't reach the route at all (403 `route_not_available`, as for the list of clinics and the onboarding routes). The same line is in each operation's Markdown, in /llms-full.txt and in what the MCP server returns, and the guide Calling /api/public with a key reads the same table, so the two can't differ. Nothing in the API changes.