---
title: insufficient_scope — Insufficient scope
description: "HTTP 403 insufficient_scope: This token does not have the required scope."
canonical_url: "https://cascades.crscreditapi.com/docs/api/errors/insufficient_scope"
doc_version: "1.0.0"
last_updated: "2026-10-09T18:04:24Z"
http_status: 403
source: config/api_error_codes.yml
---

# `insufficient_scope` — Insufficient scope

**HTTP 403 Forbidden**

Message: "This token does not have the required scope."

Envelope schema: `ErrorEnvelope` in [openapi.json](https://cascades.crscreditapi.com/openapi.json#/components/schemas/ErrorEnvelope) ([YAML](https://cascades.crscreditapi.com/openapi.yaml)).

## What causes it
- The token authenticated, but its scope list does not include every scope the operation requires; `details[].message` lists the missing scopes (for example `executions:write`).
- A read token is being used for a write operation, or an `executions:read` token is downloading artifacts or exports that need `executions:read:full`.

## How to fix it
1. Use a key issued with the scopes listed in `details`. Keys minted from the API & MCP page carry the full default set.
2. Check scope before probing IDs — scope is enforced before the record lookup, so a 403 here says nothing about whether the resource exists.

## Operations that return it
Any operation can return this code.
- [GET /workflows](/docs/api/workflows/list-workflows) — List workflows
- [POST /workflows](/docs/api/workflows/create-workflow) — Create a workflow
- [POST /workflows/generate](/docs/api/workflows/generate-workflow) — Generate a workflow from a prompt
- [GET /workflows/{id}](/docs/api/workflows/get-workflow) — Show a workflow
- [PATCH /workflows/{id}](/docs/api/workflows/update-workflow) — Update a workflow
- [DELETE /workflows/{id}](/docs/api/workflows/delete-workflow) — Delete a workflow
- [GET /workflows/{id}/test_cases](/docs/api/workflows/list-workflow-test-cases) — List sandbox test cases for a workflow
- [POST /workflows/{id}/trigger](/docs/api/workflows/trigger-workflow) — Trigger a workflow
- [GET /workflow_templates](/docs/api/workflow-templates/list-workflow-templates) — List published templates
- [GET /workflow_templates/{id}](/docs/api/workflow-templates/get-workflow-template) — Show a template (with definition)
- [GET /executions](/docs/api/executions/list-executions) — List executions
- [GET /executions/{id}](/docs/api/executions/get-execution) — Show an execution
- [POST /executions/{id}/cancel](/docs/api/executions/cancel-execution) — Cancel an execution
- [POST /executions/{id}/re_evaluations](/docs/api/executions/re-evaluate-execution) — Re-evaluate an execution
- [POST /executions/{id}/review_decisions](/docs/api/executions/submit-review-decision) — Approve or deny a paused review
- [GET /executions/{id}/review_events](/docs/api/executions/list-review-events) — List review audit events
- [POST /executions/{id}/review_assignment](/docs/api/executions/assign-review) — Claim or unassign a review
- [POST /executions/{id}/review_notes](/docs/api/executions/add-review-note) — Append a review note
- [POST /executions/review_bulk_actions](/docs/api/executions/bulk-review-actions) — Bulk approve / deny / assign_to_me
- [GET /executions/{id}/report_artifacts](/docs/api/executions/list-report-artifacts) — List credit-report PDFs for an execution
- [GET /executions/{id}/report_artifacts/{artifact_id}](/docs/api/executions/get-report-artifact) — Download a credit-report PDF
- [GET /executions/{id}/notice_artifacts](/docs/api/executions/list-notice-artifacts) — List adverse-action notice PDFs for an execution
- [GET /executions/{id}/notice_artifacts/{artifact_id}](/docs/api/executions/get-notice-artifact) — Download an adverse-action notice PDF
- [POST /workflows/{id}/batches](/docs/api/batches/create-batch) — Create a batch from N rows
- [GET /batches](/docs/api/batches/list-batches) — List batches
- [GET /batches/{id}](/docs/api/batches/get-batch) — Show a batch
- [GET /batches/{id}/executions](/docs/api/batches/list-batch-executions) — List child executions of a batch
- [POST /batches/{id}/cancel](/docs/api/batches/cancel-batch) — Cancel a batch
- [POST /batches/{id}/resume](/docs/api/batches/resume-batch) — Resume an interrupted batch
- [POST /batches/{id}/retry_failed](/docs/api/batches/retry-failed-batch) — Retry failed and skipped rows
- [GET /batches/{id}/exports.csv](/docs/api/batches/export-batch) — Download flat results CSV
- [GET /batches/{id}/exports.zip](/docs/api/batches/export-batch-zip) — Download structured ZIP of batch results
- [GET /batches/{id}/adverse_action_notices.zip](/docs/api/batches/download-batch-adverse-action-notices) — Download all adverse-action notice PDFs as a ZIP
- [GET /webhook_subscriptions](/docs/api/webhooks/list-webhook-subscriptions) — List webhook subscriptions
- [POST /webhook_subscriptions](/docs/api/webhooks/create-webhook-subscription) — Create a webhook subscription
- [GET /webhook_subscriptions/{id}](/docs/api/webhooks/get-webhook-subscription) — Show a webhook subscription
- [PATCH /webhook_subscriptions/{id}](/docs/api/webhooks/update-webhook-subscription) — Update a webhook subscription
- [DELETE /webhook_subscriptions/{id}](/docs/api/webhooks/delete-webhook-subscription) — Delete a webhook subscription
- [POST /webhook_subscriptions/{id}/rotate_secret](/docs/api/webhooks/rotate-webhook-secret) — Rotate the signing secret
- [GET /webhook_deliveries](/docs/api/webhooks/list-webhook-deliveries) — List webhook deliveries
- [GET /webhook_deliveries/{id}](/docs/api/webhooks/get-webhook-delivery) — Show a webhook delivery
- [POST /webhook_deliveries/{id}/retry](/docs/api/webhooks/retry-webhook-delivery) — Manually retry a failed or dead delivery

## Example response

```http
HTTP/1.1 403 Forbidden
Content-Type: application/json
```

```json
{
  "error": {
    "code": "insufficient_scope",
    "message": "This token does not have the required scope.",
    "details": [
      {
        "field": "scope",
        "message": "executions:write"
      }
    ],
    "request_id": "6f1c2a3e-8d4b-4c5e-9f0a-1b2c3d4e5f60",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/insufficient_scope"
  }
}
```

## Related
- [/docs/concepts/scopes-and-keys](/docs/concepts/scopes-and-keys)

[All error codes](https://cascades.crscreditapi.com/docs/api/errors.md)

## Sitemap

See the full [sitemap](https://cascades.crscreditapi.com/sitemap.md) for all pages.