type URI on every permission_denied problem body: https://docs.get-exo.com/errors/permission_denied.
HTTP status: 403 Forbidden.
Why it happens
Scopes are checked through a satisfaction lattice rather than plain membership. A route declares the finest scope it needs; a key satisfies it either directly or through an umbrella scope that grants it.write grants graph:write and memory:forget. admin grants subjects:provision and usage:read. memory:forget grants graph:write.
Two other situations produce this code. A sandbox key that tries to select a subject outside its own partition is refused here, and an API key without admin is refused on the key-management routes.
How to fix it
- Read
detail. It names the required scope and, where one exists, the umbrella scope that also satisfies it. - Mint a key with the scope you need. A key can only ever mint a key weaker than or equal to itself, so mint from a key that already holds the scope.
- If you are using a sandbox key, drop the
X-Exo-Subjectheader. Sandbox keys are bound to one partition by design.
Related
authentication_errorsubject_not_provisioned- Errors for the envelope and the full catalogue