The campaign management Web UI needs to access both the campaign list, but also the API operations to create and update campaigns.

The recommended way is to setup unique Rulesets for each access right use case, like the campaign listing and management in this case. It would be possible to create unique Rulesets for each API operation and then link all needed individual rulesets to API Keys, but it would make managing the access rights harder. Having the access rights grouped with one Ruleset for one access use case, makes things simpler in most cases.

The next article is Introduction to OAuth 2.0