TG Cerber API

Permissions (scopes)

Every credential carries scopes, and every operation needs one. A scope never adds a right: each operation also runs the console's own role check for the admin behind the credential, so a scope only narrows what that admin can already do.

Scope	Summary	Kind	What it allows
`archive:read`	Read the archive	Read	Archived chats, messages, search, chat members, edit history and files of the accounts the admin may read, plus the archive rules and the state of archive cleanups. Reading message content needs the archive password, stored with an OAuth connection or sent per request. 3 operations The latest cleanups of one account's stored archive, and what stops one. What the archive keeps of each chat, organization-wide. The organization's rules, this account's exceptions, and the rule in force for each of its chats.
`org:read`	Read the organization	Read	The organization, its accounts and their Telegram sessions, the status pages, the journal, departments, admins and their access, the subscription as the admin may see it, notification settings and AI connections. 20 operations The organization the credential belongs to: plan, licences, seats, protection and archive state. The organization's AI connections (Developer tokens and connected AI apps) and API keys. Which optional emails the admin the credential acts as receives. Who receives the organization's billing and account notifications. The Telegram accounts of the organization, with protection status and archive summary. One account in full: protection, monitoring, its Telegram sessions and their review state. The account's Telegram profile and security settings, read live from Telegram. The departments the caller may see, with the accounts filed under each. The scoped admins and AI connections that reach a department, and its accounts. Everyone who uses the console, with role, status and the accounts granted to them. The accounts granted to one admin one by one. Messages saved per account per day over the last weeks. Whether the whole archive is being deleted early, and how far it got. The organization's audit trail, newest first. Plan, licences per tier, storage, trial and the archive's lifecycle. Links to the console pages where a person buys, changes or pays for the subscription. Charges nothing. The organization's invoices, newest first, with links to view and download them. Which licence tier each account sits on, and the licences free per tier. Whether monitoring and archiving work for this organization, from what is true for its accounts. The service level, accounts, saving, storage, licences and AI connections in one answer.
`accounts:write`	Manage accounts	Write	Approve sessions, pause and resume protection, edit role labels, departments and Telegram profiles, connect or re-login accounts (the Telegram code is relayed by a person), change archive rules, start a backup, and file requests to support. Each operation still checks the role, so the billing role can only file requests and set its own mail preferences, as in the panel. 31 operations Chooses which optional emails the admin the credential acts as receives. Whether the organization's billing and account notifications go to the owner alone or to every superadmin too. Changes the account's Telegram first name, last name or bio. Stops watching the account without signing Cerber out of it; resuming needs no login. Turns protection of a paused account back on, instantly. The free-text label shown next to the account in the console (e.g. "Sales"). Changes (or clears) the account's public @username. Uploads a new profile photo to the account. Step 1 of 3: starts connecting an existing Telegram account by its number. Step 2 of 3: the login code Telegram sent to the account. Step 3 of 3: the account's 2FA password, when it has one. Where a connection attempt is now. Abandons a connection attempt that has not finished. Signs Cerber back in to an account whose monitoring session ended. The login code Telegram sent to the account, for a re-login. The account's 2FA password, when a re-login asks for it. Where a re-login of Cerber's session is now. Marks a session on the account as the employee's own, so Cerber does not sign it out. Moves one account into a department, or out of every department. Who would gain or lose access if these accounts moved. Changes nothing. Files several accounts under one department (or none) at once. Starts an archive run for the account now instead of at its next scheduled check. Lets the archive save new messages again in a chat (or the whole account) a cleanup stopped. Replaces the organization's archive rules: what the archive keeps of each chat. Replaces one account's own exceptions to the organization's archive rules. Sets or clears the rule of individual chats on one account. Asks Cerber to provide a number for a new employee. Files a request; creates nothing. Asks for more storage where it cannot be bought in the subscription. Asks Cerber for an integration with another service. Opens a conversation with Cerber support in Telegram, with the context filled in. Asks Cerber sales for an enterprise agreement. Charges nothing.
`security:write`	Change account security	Write	Sign sessions out, offboard accounts, manage the 2FA password, recovery and login email and the passkey Cerber holds, the takeover lockdown, the security lock and the paired session. 22 operations Disconnects the account: Cerber signs out of it, protection ends and the seat frees. The archive stays. Ends one Telegram session on the account now, or as soon as Telegram allows. Step 1 of 2: Telegram sends a code to the new login email. Step 2 of 2: the code from the new login email. Sets a strong 2FA password on the account that only Cerber holds. Replaces the 2FA password Cerber holds with a new one. Removes the 2FA password Cerber holds from the account. Sets or changes the account's Telegram 2FA (cloud) password to one the organization chooses. Turns the account's Telegram 2FA password off. Step 1 of 2: Telegram sends a code to the new recovery email. Step 2 of 2: the code from the new recovery email. Asks Telegram to send the recovery email code again. Drops a recovery email that was never confirmed. Registers a passkey on the account that Cerber holds, for re-logins without a code. Removes the passkey Cerber holds from the account. Whether a takeover attempt makes Cerber sign the account's other sessions out, or only alert. Turns the per-account security lock on or off. Says an admin has looked at a takeover incident on the account; the lock banner goes. Signs a second Cerber session in to the account, so protection survives losing the first. Signs Cerber's second session out of the account. The account's 2FA password, when the second session asks for it. Where setting up Cerber's second session is now.
`admins:write`	Manage admins and departments	Write	Invite admins, change their roles and access, disable, enable or remove them; create, rename and delete departments. 11 operations Adds a named group of accounts. Gives a department a new name. Deletes a department; its accounts are left with no department. Emails someone an invitation to the console, with a role and the accounts they may reach. Replaces the accounts and departments an `admin` or `archive` role reaches. Emails a pending invitation again, with a fresh link. Gives an admin another role. Stops an admin from signing in, and ends their API keys and AI connections, until enabled again. Lets a disabled admin sign in again. Deletes an admin from the organization, with their grants, API keys and AI connections. Hands ownership of the organization to another admin. The owner becomes a superadmin.
`archive:delete`	Delete archive data	Write, irreversible	Clean up stored archive data (preview, then confirm with the typed phrase), delete an account together with its archive, and delete the whole archive. Irreversible. 6 operations Removes the account from the organization entirely: protection, Cerber's session, the archive. Irreversible. Step 2 of 2: deletes what the preview listed. Irreversible. Step 1 of 2: what deleting an account's archive, or some of its chats, would delete. Deletes nothing. Cancels a cleanup that waits for the archive password or that failed, restoring what it can. Queues a failed cleanup to run again, deleting the rest of what it was confirmed to delete. Deletes the organization's entire archive now, while it is in closed storage. Irreversible.

Granting any write scope asks for the admin's console password — when an API key is created or a connection is approved. That re-entry stands in for the 10-minute confirmation the console asks for before security changes, so those operations need no extra confirmation in the call. Transferring ownership still needs the owner's current password in the request.

Operations marked Destructive sign sessions out, end protection or delete data: a program or an AI should show the person what will be done, to which account, and get their confirmation first. The three operations that delete archive data also take a confirm_phrase that the person types, exactly as in the console.

Every change is recorded in the organization's journal as the admin's, with the credential that made it.

What the API does not do

By design these stay in the console or elsewhere:

Sign-up, sign-in, accepting invitations and switching between organizations. A credential belongs to one organization and one admin; it never reaches another.
Money. Buying, upgrading, adding storage, paying, confirming a quote, cancelling, the payment method. get_billing_links returns the console pages where the person does it; nothing in the API charges anything.
Setting or changing the archive password, and the browser-side parts of the archive viewer (decrypting in the browser, remembered devices, re-sealing a chat cleanup). Message content is read through the MCP archive tools.
The QR-code sign-in of a new account: its code changes every 30 seconds and must be scanned from a screen. Connect by phone number instead.
Help-page progress, on-premises updates and the payment provider's webhook.