Skip to main content
Quick Summary: The key authenticated, but this operation is not within what it may do. There are two distinct causes with different fixes — read the detail.

​
What happened

Every operation requires the key to hold a scope (like careers:read) and the key acting person to hold the corresponding in-app permission. The effective permission is always the intersection: a scope can never grant more than the acting person could do in the app.

​
Two different fixes

  1. The key lacks the scope — detail names it. Fix: an administrator edits the key scopes under Settings → API Credentials (takes effect on the very next call). Note :write never implies :read — grant both if you need both.
  2. The acting person role denies it — the scope is granted, but the person the key acts as does not have that permission in SkillsDB. Fix: bind the key to a person with the right role, or adjust that person role. Editing scopes will NOT help here.

​
What to do

Check the detail for a named scope. If a scope is named, it is fix #1; otherwise it is fix #2.