permission_denied

HTTP status

403

Title

Permission denied

Code

permission_denied

What it means

The credential is valid, but it is not allowed to do this: the key lacks the scope the operation needs (the API reference names it under each operation), or a member's role does not allow it. A cross-site browser request to a write is refused this way too.

It is also the catch-all of status 403: an error of that status that has no more specific code answers with this one.

What to do

Use a key that holds the scope, or an account whose role allows the action.

Example

Errors are RFC 9457 problem details, sent as application/problem+json. See Errors for every field.

{
  "type": "https://docs.furniops.com/errors/permission_denied",
  "title": "Permission denied",
  "status": 403,
  "code": "permission_denied",
  "detail": "An explanation of this occurrence.",
  "request_id": "req_…",
  "doc_url": "https://docs.furniops.com/errors/permission_denied"
}

Operations that answer it

• GET /v1/agents
• PATCH /v1/agents/{agent}
• GET /v1/agreement-acceptances
• GET /v1/agreements/{kind}
• POST /v1/agreements/{kind}/acceptances
• POST /v1/assistant/conversations
• DELETE /v1/assistant/conversations/{conversation}
• POST /v1/assistant/conversations/{conversation}/turns
• PATCH /v1/assistant/me
• POST /v1/assistant/memories
• DELETE /v1/assistant/memories
• PATCH /v1/assistant/memories/{memory}
• DELETE /v1/assistant/memories/{memory}
• GET /v1/assistant/settings
• PATCH /v1/assistant/settings
• GET /v1/assistant/spend
• GET /v1/audit-events
• POST /v1/audit-events/{id}/undo
• GET /v1/billing
• POST /v1/billing/card
• GET /v1/billing/credits
• GET /v1/billing/credits/entries
• GET /v1/billing/credits/purchases
• POST /v1/billing/credits/purchases
• GET /v1/billing/credits/purchases/{purchase}
• POST /v1/billing/credits/purchases/preview
• PATCH /v1/billing/credits/settings
• PATCH /v1/billing/details
• GET /v1/billing/invoices
• POST /v1/billing/preview
• POST /v1/billing/subscription
• POST /v1/billing/subscription/cancel
• POST /v1/billing/subscription/resume
• POST /v1/billing/subscription/scheduled-change/cancel
• GET /v1/brand
• PATCH /v1/brand
• GET /v1/brand/claims
• POST /v1/brand/claims
• GET /v1/brand/claims/{id}
• POST /v1/brand/claims/{id}/check
• POST /v1/brand/claims/{id}/withdraw
• POST /v1/brand/invitations/preview
• GET /v1/catalogue
• GET /v1/catalogue/images
• GET /v1/catalogue/publication-runs
• GET /v1/catalogue/publication-runs/{id}
• POST /v1/catalogue/publish
• GET /v1/catalogue/variants
• POST /v1/catalogue/visibility
• POST /v1/catalogue/withdraw
• GET /v1/categories
• GET /v1/changes
• GET /v1/changes/recent
• POST /v1/demand
• GET /v1/exports
• POST /v1/exports
• GET /v1/exports/{id}
• GET /v1/mappings/{id}
• POST /v1/mappings/{id}/confirm
• GET /v1/match-pairs
• GET /v1/match-pairs/{id}
• POST /v1/match-pairs/{id}/dismiss
• POST /v1/match-pairs/{id}/merge
• POST /v1/match-pairs/{id}/reopen
• GET /v1/matching/judge-settings
• PATCH /v1/matching/judge-settings
• GET /v1/media/{id}
• GET /v1/merges
• GET /v1/merges/{id}
• POST /v1/merges/{id}/undo
• GET /v1/offers
• GET /v1/products
• GET /v1/products/{id}
• GET /v1/proposals
• GET /v1/proposals/{id}
• POST /v1/proposals/{id}/accept
• POST /v1/proposals/{id}/reject
• GET /v1/request-logs
• GET /v1/request-logs/{id}
• GET /v1/runs/{id}
• GET /v1/source-probes
• POST /v1/source-probes
• GET /v1/source-probes/{id}
• GET /v1/sources
• POST /v1/sources
• GET /v1/sources/{id}
• PATCH /v1/sources/{id}
• GET /v1/sources/{id}/categories
• POST /v1/sources/{id}/categories
• PUT /v1/sources/{id}/credentials
• DELETE /v1/sources/{id}/credentials
• POST /v1/sources/{id}/inbound-address/rotate
• GET /v1/sources/{id}/inbound-messages
• GET /v1/sources/{id}/mappings
• POST /v1/sources/{id}/records
• POST /v1/sources/{id}/replay
• GET /v1/sources/{id}/runs
• POST /v1/sources/{id}/runs
• POST /v1/sources/{id}/test
• POST /v1/sources/{id}/uploads
• GET /v1/stream
• POST /v1/test/events
• GET /v1/uploads/{id}
• POST /v1/uploads/{id}/complete
• GET /v1/usage
• GET /v1/usage/series
• POST /v1/variants/{id}/checks
• GET /v1/vendor-profiles
• GET /v1/vendor-profiles/{id}
• GET /v1/vendor/stats
• GET /v1/vendor/stats/products
• GET /v1/vendor/stats/series
• GET /v1/webhook-endpoints
• POST /v1/webhook-endpoints
• GET /v1/webhook-endpoints/{id}
• PATCH /v1/webhook-endpoints/{id}
• DELETE /v1/webhook-endpoints/{id}
• GET /v1/webhook-endpoints/{id}/deliveries
• GET /v1/webhook-endpoints/{id}/deliveries/{delivery}
• POST /v1/webhook-endpoints/{id}/deliveries/{delivery}/resend
• POST /v1/webhook-endpoints/{id}/recover
• POST /v1/webhook-endpoints/{id}/rotate-secret
• POST /v1/webhook-endpoints/{id}/test