X3 says „Keine Berechtigung“ or a tool is forbidden

Area: Account and access · Updated: 31 Oct 2026 · Auf Deutsch · All articles

Symptoms

  • A form says „Keine Berechtigung (conversions:write).“
  • Claude gets „Forbidden: conversions_targets_list needs scope project:admin (insufficient_scope)“.
  • The API answers 403 insufficient_scope: „missing scope: project:admin“, with required.
  • The X3 App shows „Nicht freigegeben · Dieser Bereich ist für Deine Rolle nicht freigegeben. Frag Deine Admins.“
  • Pages such as Meldungen or Werbekonten & Budget are missing under Einstellungen.

Cause

  • Your role is not enough: analysts and viewers may read but not change settings, keys, reporting or ad accounts. Owners and admins may do everything in the project.
  • The API key was created with fewer scopes or for single projects only.
  • The Claude connection was granted fewer scopes, or it is the public docs server (/mcp/public) without sign-in.
  • Contact data of leads additionally needs the contact-data permission (leads:read).

How to fix it

1. Read the missing scope

  • In the dashboard: Error message › text in brackets, e.g. „(project:admin)“
  • With Claude (MCP): kb_search {"query":"insufficient_scope project:admin"}

The message names the missing scope. project:admin means owner or admin in the project, ads:write write access to ad accounts, conversions:write sending reports.

2. Look at your role

  • In the dashboard: Team › Team & Rollen
  • With Claude (MCP): auth_whoami {"project":"my-shop"}
  • The MCP tool exists since the update of 31 Oct 2026; before, project_list only showed which projects the connection reaches.

auth_whoami shows per organization your role, the scopes this connection really holds and under missingFromRole the scopes your role would allow but the connection lacks: then connecting Claude again and ticking the boxes is enough (step 4). With project also the scopes in that project. members_list shows everybody's role (owners and admins only).

3. Get a higher role

  • In the dashboard: Team › Team & Rollen › person › Rolle › Admin
  • With Claude (MCP): No MCP tool (owners and admins of the organization change roles in the dashboard)

4. Create the key or the Claude connection again with the right scopes

  • In the dashboard: Kunden & Team › Schlüssel › Neuer Schlüssel (or Kunden & Team › KI-Apps › disconnect and connect again)
  • With Claude (MCP): keys_create {"org":"my-company","name":"server","scopes":["analytics:read","conversions:write"]}

Keep secret keys in server environment variables only, never in code or chat.

How to tell it worked

  • The page or the tool works without „Keine Berechtigung“.
  • Claude no longer gets insufficient_scope for the tool.