# insufficient_scope (/en/docs/errores/insufficient_scope)

The key is missing a scope this endpoint requires.

|                |                                                    |
| -------------- | -------------------------------------------------- |
| **Code**       | `insufficient_scope`                               |
| **Type**       | `permission_error` — Valid credential, not allowed |
| **HTTP**       | `403`                                              |
| **Retriable?** | No                                                 |

## What to do [#what-to-do]

`error.details.required_scope` names the missing scope and `error.details.mint` is the call that produces a key carrying it — `POST /v1/api_keys` from a root key, `POST /dashboard/api_keys` from an account session. A human can also mint one at [https://app.facturia.cl/llaves](https://app.facturia.cl/llaves). Scopes are fixed at mint time: a key is replaced, never widened.

> **Warning**
>
> Retrying the same request will fail the same way. Change the request, not the frequency.

## The envelope [#the-envelope]

```json
{
  "error": {
    "type": "permission_error",
    "code": "insufficient_scope",
    "message": "…",
    "hint": "`error.details.required_scope` names the missing scope and `error.details.mint` is the call that produces a key carrying it — `POST /v1/api_keys` from a root key, `POST /dashboard/api_keys` from an account session. A human can also mint one at https://app.facturia.cl/llaves. Scopes are fixed at mint time: a key is replaced, never widened.",
    "retriable": false,
    "doc_url": "https://docs.facturia.cl/errors/insufficient_scope",
    "request_id": "req_01K2R7Q9M4T2VB"
  }
}
```

Program against `code`, never against `message` — the prose can be rewritten, the code cannot (§5.8).

`hint` and `retriable` arrive in the response with these exact values: they are a function of `code` and come from the same dictionary `GET /v1/error_codes` serves, so the envelope and the dictionary cannot disagree. Both are English on the wire by design — one registry, one language. More in [The error envelope](/en/docs/errores).

## See also [#see-also]

- [Every code](/en/docs/errores/codigos): The full table, grouped by where you will run into it.

- [The error envelope](/en/docs/errores): The nine types, the request_id and how to handle them in practice.

The machine-readable copy of this page lives at `GET /v1/error_codes`, unauthenticated.