forbidden_action
The action is refused even though the scope is right. The usual reasons are: your credential reaches the tax ID through an account relation (access granted to your account, or a managed account) and the operation belongs to the account that owns the tax ID — request logs, events, webhook endpoints, account billing, automation usage and writes of connected payment credentials are never available through a relation; the tax ID belongs to a managed account whose holder already pays for it, so its provider can read it and edit its data but can no longer activate, deactivate or archive it; the person who issued the credential is not an owner or admin of the account, or the credential does not reach every tax ID of the account; or the resource belongs to a shared catalogue, or the change travels through a different endpoint.
| Code | Type | HTTP | Category |
|---|---|---|---|
forbidden_action | authorization_error | 403 | Authorization |
Cause
The action is refused even though the scope is right. The usual reasons are: your credential reaches the tax ID through an account relation (access granted to your account, or a managed account) and the operation belongs to the account that owns the tax ID — request logs, events, webhook endpoints, account billing, automation usage and writes of connected payment credentials are never available through a relation; the tax ID belongs to a managed account whose holder already pays for it, so its provider can read it and edit its data but can no longer activate, deactivate or archive it; the person who issued the credential is not an owner or admin of the account, or the credential does not reach every tax ID of the account; or the resource belongs to a shared catalogue, or the change travels through a different endpoint.
What to do
Read error.message and error.subcode: they say which case applies and name the canonical route when the change travels through another endpoint. For an operation that belongs to the owning account, use a credential of that account (its owner or admin): a relation never opens it. For a managed account paid by its holder, keep to reading and editing data and leave activation and archiving to the holder. If the issuer is not an owner or admin, ask one of them to issue the credential with the full scope of the account.