forbidden

The credentials are valid, but they do not permit this operation. This is almost always a missing scope.

Example response

HTTP/1.1 403 Forbidden
Content-Type: application/problem+json
X-Request-ID: 7d1e9c2a-3b4f-4c5d-8e6f-9a0b1c2d3e4f

{
  "type": "https://docs.talero.dk/problems/forbidden",
  "title": "Permission denied",
  "status": 403,
  "detail": "Missing required scope: invoices:write",
  "code": "forbidden"
}

Common causes

• The API key or OAuth grant lacks the scope the endpoint requires — for example calling POST /api/v1/invoices with a key that only has invoices:read.
• Webhook management endpoints were called without the webhooks:manage scope.
• An OAuth token is being used for an operation outside the scopes the user consented to.

How to fix it

• The detail field names the missing scope. Compare it with the scopes on your credential.
• API key scopes cannot be broadened after creation: create a new key with the required scopes and revoke the old one.
• For OAuth, request the additional scope in a new authorization flow so the user can consent to it.
• Follow least privilege: request only the scopes the integration actually uses — see the scopes table.

If the problem persists, contact [email protected] and quote the X-Request-ID header from the failing response.