> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nordicfinancialnews.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Insufficient permissions

> The 403 problem type returned when a valid API key is not permitted to make the request.

<Info>
  Problem type: `https://docs.nordicfinancialnews.com/problems/auth-insufficient`
</Info>

The API returns this problem type with HTTP `403` when your API key is recognized and active, but is not permitted to make the request you made. Two things produce it:

* **The key lacks the scope the endpoint requires.** Most endpoints require `read`. Watchlist endpoints, and watchlist filters on other endpoints, require `read:watchlist`.
* **The key has an IP allowlist and your request did not come from an address on it.** An allowlist is optional. If you have not set one, this cause does not apply to you.

## Example response

```json theme={"dark"}
{
  "type": "https://docs.nordicfinancialnews.com/problems/auth-insufficient",
  "title": "Insufficient permissions",
  "status": 403,
  "detail": "Valid API key but insufficient entitlements for this resource",
  "instance": "urn:request:7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c"
}
```

`detail` is a fixed string. It does not name the missing scope and it does not distinguish a scope failure from an allowlist failure, so check both.

## How to fix it

Open [API key settings](https://nordicfinancialnews.com/settings/api_keys) and check the key's scopes against what the endpoint needs, then check its IP allowlist against where your code actually runs. A deployment that moved hosts, or one that egresses through a new address, produces this error with no change to your code at all.

Scopes are fixed at the key's current value for every request it makes, so widening them means editing the key rather than asking for more at call time. See [API key scopes and permissions](/guides/authentication#api-key-scopes-and-permissions).

Retrying does not help, with one exception: if the cause was an allowlist and your egress address varies, the same request can succeed from a different address. That is worth fixing at the allowlist rather than relying on.

## Not the same as the other 403

[Plan limit exceeded](/problems/plan-limit-exceeded) also returns `403`. The two say different things and have different remedies:

|               | This problem type                  | Plan limit exceeded                               |
| ------------- | ---------------------------------- | ------------------------------------------------- |
| What is wrong | Your **key** is not permitted      | Your **plan** does not reach the content          |
| How to fix    | Edit the key's scopes or allowlist | Upgrade, or use the alternative named in `detail` |

Branch on `type` rather than on the status code, or you will send someone to the upgrade page over a missing scope.

## Related

* [Authentication](/guides/authentication) for the full scope list and how keys are configured
* [Error handling](/guides/errors) for the full problem type list
* [Authentication required](/problems/auth-invalid) for the `401` returned when the key itself is missing or invalid