# 403 Forbidden on /data/api/v1/scan/projects using Ignition 8.3 API Key **URL:** \ **Category:** Ignition\ **Created:** [July 9, 2026, 10:25am UTC](https://forum.inductiveautomation.com/t/403-forbidden-on-data-api-v1-scan-projects-using-ignition-8-3-api-key/116321 "2026-07-09T10:25:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rohith.jp](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rohith.jp](https://forum.inductiveautomation.com/u/rohith.jp)\ **Post date:** [July 9, 2026, 10:25am UTC](https://forum.inductiveautomation.com/t/403-forbidden-on-data-api-v1-scan-projects-using-ignition-8-3-api-key/116321/1 "2026-07-09T10:25:31Z")
I am triggering a project filesystem scan from GitHub Actions. The network path, HTTPS protocol, and header syntax (`X-Ignition-API-Token`) are working perfectly, but the gateway returns an HTTP **`403 Forbidden`**. The request is successfully reaching Ignition, but the gateway is explicitly denying permission. **The Root Blocker** : - My API Key is mapped to a custom security level: **`Authenticated/API_RW`**. - Because Ignition 8.3 blocks assigning built-in user roles (like `Roles/Administrator`) directly to API Keys, my token lacks the administrative privileges needed to touch disk-level system paths. **Question** : My API key is getting rejected with a 403 Forbidden error on the POST /data/api/v1/scan/projects route. Because Ignition 8.3 blocks assigning built-in user roles (like Roles/Administrator) directly to API Keys, my token is stuck with a custom security level (Authenticated/API\_RW). Which specific Service Security Policy or internal gateway configuration governs this Git-scan endpoint so I can explicitly authorize API\_RW to trigger it? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 9, 2026, 12:00pm UTC](https://forum.inductiveautomation.com/t/403-forbidden-on-data-api-v1-scan-projects-using-ignition-8-3-api-key/116321/2 "2026-07-09T12:00:54Z")
Have you done this step? > [@Ignition 8.3 API Usage Guide (via Postman)](https://forum.inductiveautomation.com/t/ignition-8-3-api-usage-guide-via-postman/93935/1): > > 1. In `Platform > Security > General Settings`, assign the write-level Security Level to `Gateway Write Permissions` and choose the "AnyOf" option (unless intent is otherwise): > > ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/9/e993d1437c6d4e40aeee4ea0bb6bd6991fa7d98e.png) ---
**Author:** ![rohith.jp](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rohith.jp](https://forum.inductiveautomation.com/u/rohith.jp)\ **Post date:** [July 9, 2026, 12:05pm UTC](https://forum.inductiveautomation.com/t/403-forbidden-on-data-api-v1-scan-projects-using-ignition-8-3-api-key/116321/3 "2026-07-09T12:05:03Z")
But I don't see the API tokens in the gateway write permissions ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/3/135e2522bf622941ea93a0c9015022affe2a6171.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 9, 2026, 12:14pm UTC](https://forum.inductiveautomation.com/t/403-forbidden-on-data-api-v1-scan-projects-using-ignition-8-3-api-key/116321/4 "2026-07-09T12:14:25Z")
Those are custom security levels you would add in a previous step. ---
**Author:** ![rohith.jp](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rohith.jp](https://forum.inductiveautomation.com/u/rohith.jp)\ **Post date:** [July 9, 2026, 2:15pm UTC](https://forum.inductiveautomation.com/t/403-forbidden-on-data-api-v1-scan-projects-using-ignition-8-3-api-key/116321/5 "2026-07-09T14:15:48Z")
Thanks for your support and guidance. Since I'm new to Ignition, this was extremely helpful for me