forbidden

The key is valid, but it is not allowed to do this — either the scope is missing or the resource belongs to another workspace.

• The key was created without the scope this endpoint requires.
• The resource id in the path belongs to a different workspace. Cross-tenant reads return 403 rather than 404 only where the caller is already known to be authenticated for something.
• The endpoint is restricted to workspace owners and the key was issued to a member.

• Check the scopes on the key against the endpoint's requirement in the API reference.
• Issue a new key with the scope you need rather than widening an existing one — narrow keys are the point.
• Confirm the resource id belongs to the workspace the key was issued in.

{
  "error": {
    "code": "forbidden",
    "message": "The key is valid, but it is not allowed to do this — either the scope is missing or the resource belongs to another workspace",
    "request_id": "7cb7f7862a82425d8e4c3fb8a497dfe6"
  },
  "type": "https://integrable.cloud/docs/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "The key is valid, but it is not allowed to do this — either the scope is missing or the resource belongs to another workspace",
  "instance": "/api/bots/01a0652b-3713-7ea1-a6c9-2e895389ec34"
}

Branch on error.code, not on the message — the code is stable, the sentence is not. Log request_id either way.

Codes that are easy to confuse with this one, or that show up alongside it:

• unauthenticated
• not_found

Quote the request_id from the response — hello@integrable.cloud. It is what lets us find the exact request. The full list of codes is at Error codes, and the conventions every endpoint shares are in Retries, versioning and limits.