# The token lacks a scope

> insufficient-scope: HTTP 403. Ask the user to approve the scope named in required_scope, then retry.

Source: https://emailmovers.com/mydatahub/docs/errors/insufficient-scope

`insufficient-scope` is returned with HTTP status 403. Its type URI is `https://emailmovers.com/mydatahub/docs/errors/insufficient-scope`.

## What it means

The token or key does not hold a scope the operation needs. required_scope names it, and a WWW-Authenticate step-up challenge lets an OAuth client ask for it.

## What to do

Ask the user to approve the scope named in required_scope, then retry.

## Members it adds

Beyond `type`, `title`, `status`, `detail`, `code` and `next_step`, this problem carries `required_scope`. They are published in the `Problem` schema of the OpenAPI document.

## Example

```json
{
  "type": "https://emailmovers.com/mydatahub/docs/errors/insufficient-scope",
  "title": "The token lacks a scope",
  "status": 403,
  "code": "insufficient-scope",
  "detail": "This operation needs the orders:write scope.",
  "next_step": "Ask the user to approve the scope named in required_scope, then retry.",
  "required_scope": "orders:write"
}
```

## See also

- [Authentication](https://emailmovers.com/mydatahub/docs/authentication.md)

All problem types are listed on [Errors](https://emailmovers.com/mydatahub/docs/errors.md).