---
title: "403 Forbidden"
description: "QuotaStack knows who you are, and this key may not do that."
---

# 403 Forbidden

`https://api.quotastack.io/errors/forbidden`

QuotaStack knows who you are, and this key may not do that.

## Why it happened

- The key lacks the scope the call wants, such as `subscriptions:write`.
- You called an account or platform endpoint with a tenant API key.

## How to fix it

1. Check what the key may do, in the [dashboard](https://platform.quotastack.io).
2. Use your dashboard session for account calls. Your application never makes them.

### Example response 403

```json
{
  "type": "https://api.quotastack.io/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "This API key does not have access to that resource."
}
```

## Which calls return this

- [`POST /v1/admin/api-keys`](/docs/api/account#adminCreateAPIKey)
- [`POST /v1/admin/api-keys/{id}/revoke`](/docs/api/account#adminRevokeAPIKey)
- [`GET /v1/admin/tenants/{tenant_id}/config`](/docs/api/account#adminGetTenantConfig)
- [`PATCH /v1/admin/tenants/{tenant_id}/config`](/docs/api/account#adminUpdateTenantConfig)
- [`POST /v1/admin/tenants/{tenant_id}/webhook-secret/rotate`](/docs/api/account#adminRotateWebhookSecret)
- [`POST /v1/tenants/{id}/live-access/approve`](/docs/api/account#approveTenantLiveAccess)
- [`POST /v1/tenants/{id}/live-access/reject`](/docs/api/account#rejectTenantLiveAccess)
- [`POST /v1/tenants/{id}/live-access/suspend`](/docs/api/account#suspendTenantLiveAccess)
- [`POST /v1/tenants/{id}/sandbox-access/suspend`](/docs/api/account#suspendTenantSandboxAccess)
- [`POST /v1/tenants/{id}/sandbox-access/enable`](/docs/api/account#enableTenantSandboxAccess)

## See also

- [API conventions](/docs/concepts/conventions)