Docs | Kash

HTTP status: 403 · Title: “Insufficient scope”

When it fires

The key authenticated successfully but does not carry the scope the endpoint requires.

Why it happens

The key was issued with a narrower set of scopes than the endpoint needs, for example a markets:read key calling POST /v1/trades, which requires trades:write.
A newer endpoint requires a scope your existing key does not carry.

How to fix

Check the endpoint’s required scope in the table below or in the Endpoint reference.
Issue a key with the scopes you need (or revoke the old one and issue a replacement).
Follow least privilege: don’t add scopes you don’t need. A narrow key limits the damage if it leaks.

Scope	Endpoints
`markets:read`	`GET /v1/markets`, `GET /v1/markets/:id`, `GET /v1/markets/:id/predictions`, `GET /v1/markets/:id/disputes`
`markets:quote`	`GET /v1/markets/:id/quote`
`trades:read`	`GET /v1/trades`, `GET /v1/trades/:id`, `GET /v1/traces/:correlationId`
`trades:write`	`POST /v1/trades`, `POST /v1/trades/:id/confirm`, `POST /v1/redemptions`, `POST /v1/markets/:id/disputes`
`portfolio:read`	`GET /v1/portfolio`, `GET /v1/portfolio/positions`
`webhooks:manage`	`GET /v1/webhooks/events`, `POST /v1/webhooks/events/:eventId/redeliver`, `POST /v1/auth/api-keys/me/webhook-secret/rotate`
`auth:manage`	`GET /v1/account/usage`

See Authentication for how scopes are assigned.

IP_NOT_ALLOWED — also 403, caused by the key’s IP allowlist rather than its scopes
ORGANIZATION_INACTIVE — also 403, caused by the key’s account