# `forbidden_scope`

**Status 403.** This key does not carry the scope this call needs.

## What it means

The key does not have the permission this call needs. `required_scope` names it and `key_scopes` lists the permissions the key has.

## What to do

A key's permissions are fixed when it is made. Make a new key with the permission on the API keys screen in the app, and revoke the old one if nothing needs it.

## Safe to send again?

Not as it is. Change what the answer points to, then send the request.

## What else the answer carries

- `required_scope`: A scope a key can hold. This list is exactly the scopes some operation checks. `write_members` covers the two writes (changing a member's points, cancelling a reward code) and also covers `read_members`. The self-revoke needs no scope. `write_webhooks` covers the webhook endpoints — listing, creating, deleting and testing them — and a key for an AI assistant can never hold it. `write_programme` covers changing the programme (`POST /stores/{store_key}/programme`); a key for an assistant may hold it, and must preview each change and send back its confirmation.
- `key_scopes`: Every scope this key holds.

## Where you can meet it

- [`GET /stores`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#listStores): Every store on this account
- [`GET /stores/{store_key}`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#getStore): One store
- [`GET /stores/{store_key}/programme`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#getProgramme): A store's programme: what is stored, the settings in force, what shoppers are actually paid, and the expiry rule
- [`POST /stores/{store_key}/programme`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#updateProgramme): Change the earn rate, the bonuses, what a point is worth, referrals, spending any amount, the time zone, the ways to earn, or when points expire
- [`GET /stores/{store_key}/programme/rewards`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#listRewards): The rewards a shopper can spend points on at this store
- [`POST /stores/{store_key}/programme/rewards`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#addReward): Add a reward shoppers can spend points on
- [`POST /stores/{store_key}/programme/rewards/{reward_id}`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#changeReward): Change a reward's cost, value, minimum order or label
- [`POST /stores/{store_key}/programme/rewards/{reward_id}/remove`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#removeReward): Remove a reward
- [`GET /stores/{store_key}/programme/offers`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#listOffers): A store's offers
- [`POST /stores/{store_key}/programme/offers`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#addOffer): Add an offer: a campaign, a product offer or a channel offer
- [`POST /stores/{store_key}/programme/offers/{offer_id}`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#changeOffer): Change an offer
- [`POST /stores/{store_key}/programme/offers/{offer_id}/remove`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#removeOffer): Remove an offer
- [`GET /stores/{store_key}/programme/rules`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#listRules): The earn rules in force at this store
- [`GET /stores/{store_key}/design`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#getDesign): A store's design: the colours, words and look of the rewards panel, the product-page line and the account page
- [`POST /stores/{store_key}/design`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#updateDesign): Change the design: colours, words, the panel and product-line look, the account page layout, the terms link
- [`GET /members`](https://matrixrewards.co.uk/docs/api/2026-10/members.md#listMembers): Shoppers on this account
- [`GET /members/{member_key}`](https://matrixrewards.co.uk/docs/api/2026-10/members.md#getMember): One shopper's record
- [`GET /members/{member_key}/codes`](https://matrixrewards.co.uk/docs/api/2026-10/members.md#listMemberCodes): The reward codes this shopper holds
- [`POST /members/{member_key}/adjustments`](https://matrixrewards.co.uk/docs/api/2026-10/members.md#adjustMemberPoints): Add points to a member's balance, or take them away
- [`POST /members/{member_key}/codes/void`](https://matrixrewards.co.uk/docs/api/2026-10/members.md#cancelMemberCode): Cancel a reward code and give the member back its points
- [`GET /ledger`](https://matrixrewards.co.uk/docs/api/2026-10/reports.md#listLedger): Every points movement on this account, newest first
- [`GET /reports/liability`](https://matrixrewards.co.uk/docs/api/2026-10/reports.md#getLiabilityReport): What this account owes its shoppers
- [`GET /reports/settlement`](https://matrixrewards.co.uk/docs/api/2026-10/reports.md#getSettlementReport): Points earned at one store and spent at another, inside a window
- [`GET /usage`](https://matrixrewards.co.uk/docs/api/2026-10/billing.md#getUsage): Orders that earned points this billing month, against the plan's cap
- [`GET /plan`](https://matrixrewards.co.uk/docs/api/2026-10/billing.md#getPlan): The subscriptions recorded for this account
- [`GET /audit-log`](https://matrixrewards.co.uk/docs/api/2026-10/log.md#listAuditLog): What every key changed, and what it was shown
- [`GET /keys`](https://matrixrewards.co.uk/docs/api/2026-10/account.md#listKeys): The API keys on this account
- [`GET /webhooks`](https://matrixrewards.co.uk/docs/api/2026-10/webhooks.md#listWebhookEndpoints): The webhook endpoints on this account, and why any stopped
- [`POST /webhooks`](https://matrixrewards.co.uk/docs/api/2026-10/webhooks.md#createWebhookEndpoint): Send points movements to an https endpoint
- [`DELETE /webhooks/{endpoint_id}`](https://matrixrewards.co.uk/docs/api/2026-10/webhooks.md#deleteWebhookEndpoint): Stop sending to an endpoint
- [`POST /webhooks/{endpoint_id}/test`](https://matrixrewards.co.uk/docs/api/2026-10/webhooks.md#testWebhookEndpoint): Send one signed test event now
- [`GET /stores/{store_key}/brand`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#getStoreBranding): A store's name and branding as the Matrix Rewards website shows them, and what Shopify has
- [`GET /stores/{store_key}/images`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#listBrandImages): The pictures uploaded to a store, newest first
- [`POST /stores/{store_key}/images`](https://matrixrewards.co.uk/docs/api/2026-10/stores.md#uploadBrandImage): Upload a picture for the store's branding (a logo, a square logo, a cover)

Every code, and the shape of an error answer: [Errors](https://matrixrewards.co.uk/docs/errors.md).

---

Page: https://matrixrewards.co.uk/docs/errors/forbidden_scope
Contract: 2026-10 sha256:35af153960028890fea5738799f5a71e535e1eea4dd3f6b8d5f50b37f02363da