> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin required

# `admin_required`

| HTTP | When                                                                                                       |
| ---- | ---------------------------------------------------------------------------------------------------------- |
| 403  | The caller holds the right scope but is not an admin of the workspace the action's shared data belongs to. |

Some destructive actions need more than a scope: they need proven
workspace-admin authority. Deleting a **workspace-wide** knowledge
document — one every project in the workspace can see — is admin-only;
project-scoped documents are not affected. Two verbs reach that rule:

* **`delete_knowledge_doc`** (MCP), on a document whose `scope` is
  `WORKSPACE`.
* **`delete_source`** (MCP) and **`DELETE /v1/sources/{sourceId}`**
  (REST) — the only REST endpoint that can raise this — when the
  source's knowledge-base copy of its transcript was shared with the
  whole company. Deleting the source deletes that copy for everyone, so
  it carries the same requirement. The proposal returned by phase one
  counts those documents in
  `data.toDelete.workspaceSharedKnowledgeDocuments`, and both
  confirmation phases enforce the rule, so a caller who would be refused
  cannot mint a proposal either.

```json theme={null}
{
  "error": {
    "code": "admin_required",
    "message": "Deleting a workspace-wide knowledge document requires an admin of the workspace that document is shared with.",
    "request_id": "req_…",
    "docs_url": "https://docs.scripe.io/api/v1/errors#admin_required"
  }
}
```

Two ways to hit this:

* The OAuth grant belongs to a member, not an admin, **of the workspace
  that document is shared with**. That is usually the workspace you are
  working in, but not always: moving a project between workspaces leaves
  its company-shared documents behind in the old one, so a source can
  carry a shared copy that belongs elsewhere. Have an admin of *that*
  workspace run the action, or ask them to promote the account.
* The call came from an **API key**. A key carries no acting user, so
  admin authority can never be established for it. (In practice a key
  cannot reach this at all: the `*:destroy` family is not grantable to
  API keys — see [auth.md §1.2](../auth.md#12-scopes).)

Retrying without changing who is calling will always fail the same way.