forbidden_scope

Status 403. This key does not carry the scope this call needs.

What it means

The key does not have the permission this call needs. required_scope names it and key_scopes lists the permissions the key has.

What to do

A key's permissions are fixed when it is made. Make a new key with the permission on the API keys screen in the app, and revoke the old one if nothing needs it.

Safe to send again?

Not as it is. Change what the answer points to, then send the request.

What else the answer carries

• required_scope: A scope a key can hold. This list is exactly the scopes some operation checks. write_members covers the two writes (changing a member's points, cancelling a reward code) and also covers read_members. The self-revoke needs no scope. write_webhooks covers the webhook endpoints — listing, creating, deleting and testing them — and a key for an AI assistant can never hold it. write_programme covers changing the programme (POST /stores/{store_key}/programme); a key for an assistant may hold it, and must preview each change and send back its confirmation.
• key_scopes: Every scope this key holds.

Where you can meet it

• GET /stores: Every store on this account
• GET /stores/{store_key}: One store
• GET /stores/{store_key}/programme: A store's programme: what is stored, the settings in force, what shoppers are actually paid, and the expiry rule
• POST /stores/{store_key}/programme: Change the earn rate, the bonuses, what a point is worth, referrals, spending any amount, the time zone, the ways to earn, or when points expire
• GET /stores/{store_key}/programme/rewards: The rewards a shopper can spend points on at this store
• POST /stores/{store_key}/programme/rewards: Add a reward shoppers can spend points on
• POST /stores/{store_key}/programme/rewards/{reward_id}: Change a reward's cost, value, minimum order or label
• POST /stores/{store_key}/programme/rewards/{reward_id}/remove: Remove a reward
• GET /stores/{store_key}/programme/offers: A store's offers
• POST /stores/{store_key}/programme/offers: Add an offer: a campaign, a product offer or a channel offer
• POST /stores/{store_key}/programme/offers/{offer_id}: Change an offer
• POST /stores/{store_key}/programme/offers/{offer_id}/remove: Remove an offer
• GET /stores/{store_key}/programme/rules: The earn rules in force at this store
• GET /stores/{store_key}/design: A store's design: the colours, words and look of the rewards panel, the product-page line and the account page
• POST /stores/{store_key}/design: Change the design: colours, words, the panel and product-line look, the account page layout, the terms link
• GET /members: Shoppers on this account
• GET /members/{member_key}: One shopper's record
• GET /members/{member_key}/codes: The reward codes this shopper holds
• POST /members/{member_key}/adjustments: Add points to a member's balance, or take them away
• POST /members/{member_key}/codes/void: Cancel a reward code and give the member back its points
• GET /ledger: Every points movement on this account, newest first
• GET /reports/liability: What this account owes its shoppers
• GET /reports/settlement: Points earned at one store and spent at another, inside a window
• GET /usage: Orders that earned points this billing month, against the plan's cap
• GET /plan: The subscriptions recorded for this account
• GET /audit-log: What every key changed, and what it was shown
• GET /keys: The API keys on this account
• GET /webhooks: The webhook endpoints on this account, and why any stopped
• POST /webhooks: Send points movements to an https endpoint
• DELETE /webhooks/{endpoint_id}: Stop sending to an endpoint
• POST /webhooks/{endpoint_id}/test: Send one signed test event now
• GET /stores/{store_key}/brand: A store's name and branding as the Matrix Rewards website shows them, and what Shopify has
• GET /stores/{store_key}/images: The pictures uploaded to a store, newest first
• POST /stores/{store_key}/images: Upload a picture for the store's branding (a logo, a square logo, a cover)

Every code, and the shape of an error answer: Errors.