> ## Documentation Index
> Fetch the complete documentation index at: https://docs.get-exo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permission denied

> The credential is valid but does not carry the scope this operation requires.

This page is the resolution target of the RFC 9457 `type` URI on every `permission_denied` problem body: `https://docs.get-exo.com/errors/permission_denied`.

**HTTP status: `403` Forbidden**.

```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
{
  "type": "https://docs.get-exo.com/errors/permission_denied",
  "title": "Permission denied",
  "status": 403,
  "detail": "This operation requires the 'memory:forget' scope. A key carrying 'write' also qualifies.",
  "code": "permission_denied",
  "requestId": "req_9f2c41ab7d0e5c18",
  "suggestedAction": "Use an API key that carries the 'memory:forget' scope (or 'write')."
}
```

## Why it happens

Scopes are checked through a satisfaction lattice rather than plain membership. A route declares the finest scope it needs; a key satisfies it either directly or through an umbrella scope that grants it. `write` grants `graph:write` and `memory:forget`. `admin` grants `subjects:provision` and `usage:read`. `memory:forget` grants `graph:write`.

Two other situations produce this code. A sandbox key that tries to select a subject outside its own partition is refused here, and an API key without `admin` is refused on the key-management routes.

## How to fix it

* Read `detail`. It names the required scope and, where one exists, the umbrella scope that also satisfies it.
* Mint a key with the scope you need. A key can only ever mint a key weaker than or equal to itself, so mint from a key that already holds the scope.
* If you are using a sandbox key, drop the `X-Exo-Subject` header. Sandbox keys are bound to one partition by design.

## Related

* [`authentication_error`](/errors/authentication_error)
* [`subject_not_provisioned`](/errors/subject_not_provisioned)
* [Errors](/platform/errors) for the envelope and the full catalogue