DocumentationExperience Cloud KCS

AEM Cloud Manager OAuth S2S credential receives 403 on createContentFlow without administrator profile

Last update: August 18, 2026

This article describes how to resolve a 403 Forbidden error that occurs when using an OAuth Server-to-Server credential to create a content flow in Adobe Experience Manager Cloud Manager, due to missing administrator profile assignments.

Description description

Environment

Adobe Experience Manager (AEM) Cloud Manager (all versions)

Symptoms

When automating AEM content synchronization using a CI/CD pipeline that calls the Cloud Manager API to create a content flow between environments, the following error occurs when using an OAuth Server-to-Server (S2S) credential:

403 Forbidden - User does not have the necessary permissions for this operation.

  • The S2S credential is assigned to all relevant Cloud Manager product profiles (such as AEM - Content Copy, Deployment Manager).
  • The same API operation succeeds when performed as a named user via the Adobe I/O CLI.
  • The failing API call is a POST to the Cloud Manager API endpoint for content flow creation with valid parameters.
  • The S2S credential has the full set of available Cloud Manager scopes.

Cause

The technical account used by the S2S credential isn’t a member of the AEM Administrator product profiles for the participating Author environments. Assigning the technical account to the appropriate administrator profiles resolves the permission issue.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Confirm that the OAuth Server-to-Server credential is assigned to all required Cloud Manager product profiles (such as AEM - Content Copy and Deployment Manager).
  2. In the Adobe Admin Console, locate the technical account associated with the S2S credential.
  3. Add this technical account to the AEM Administrator product profiles for each Author environment participating in the content flow. Ensure the correct program and environment IDs are selected.
  4. Wait for permissions to propagate (this may take several minutes).
  5. Retry the createContentFlow API call using the S2S credential. The operation should now succeed without a 403 error.
recommendation-more-help
experience-cloud-kcs-help-kbarticles