​

admin_required

• delete_knowledge_doc (MCP), on a document whose scope is WORKSPACE.
• delete_source (MCP) and DELETE /v1/sources/{sourceId} (REST) — the only REST endpoint that can raise this — when the source’s knowledge-base copy of its transcript was shared with the whole company. Deleting the source deletes that copy for everyone, so it carries the same requirement. The proposal returned by phase one counts those documents in data.toDelete.workspaceSharedKnowledgeDocuments, and both confirmation phases enforce the rule, so a caller who would be refused cannot mint a proposal either.

{
  "error": {
    "code": "admin_required",
    "message": "Deleting a workspace-wide knowledge document requires an admin of the workspace that document is shared with.",
    "request_id": "req_…",
    "docs_url": "https://docs.scripe.io/api/v1/errors#admin_required"
  }
}

• The OAuth grant belongs to a member, not an admin, of the workspace that document is shared with. That is usually the workspace you are working in, but not always: moving a project between workspaces leaves its company-shared documents behind in the old one, so a source can carry a shared copy that belongs elsewhere. Have an admin of that workspace run the action, or ask them to promote the account.
• The call came from an API key. A key carries no acting user, so admin authority can never be established for it. (In practice a key cannot reach this at all: the *:destroy family is not grantable to API keys — see auth.md §1.2.)