CustomScopeModifications

Rights removed from the parent scope, per object. Each key is an API object name, such as phonenumber, device, route, or nsconfig, and an unknown name is refused. Each value is one of these limits:

none: the object is refused.

ro: reads, lists, and counts only.

update-only: reads, lists, counts, and updates.

no-delete: everything but deletes.

An object not listed keeps the parent's rights.

{
    "nsconfig": "none",
    "route": "ro",
    "device": "no-delete",
    "phonenumber": "update-only"
}