forbidden_scope

HTTP 403. Insufficient scope.

When you see it

The credential is valid but was not granted the scope this route needs. Also: an app session (a first-party JWT) on a content route: the server never receives the encryption key with one, so it cannot read or write content for it.

What to do

Request the scope at authorization time. Note that tasks:read/tasks:write do NOT imply sessions:* or webhooks:write. Those are granted by name. For content, use an access key or an OAuth token, not the app’s session.

The body

type is https://devs.inittasks.com/errors/forbidden_scope. instance is the path that failed, here /v1/webhooks. For the full RFC 9457 shape, the request_id field and the retry rules, see errors and retries.