DocumentationExperience Cloud KCS

AEM as a Cloud Service: Resolve 403 missing required scopes error with Persisted Query API and OAuth Server-to-Server

Last update: October 8, 2026

Learn how to resolve the 403 Forbidden missing required scopes error when accessing the AEM Persisted Query API using OAuth Server-to-Server credentials.

Description description

Environment

Adobe Experience Manager as a Cloud Service (AEMaaCS) (all versions)

Symptoms

  • When attempting to access Persisted Query API endpoints (such as https:// .adobeaemcloud.com/graphql/execute.json/ / ) using OAuth Server-to-Server credentials, the following error occurs 403, message: ‘AEM authorization failed — check the technical account’s AEM group/ACL permissions on this path: {“type”:“https://api.adobeaemcloud.com/adobe/meta/errors/forbidden”,“title”:“Forbidden”,“status”:403,“detail”:“The access token is missing required scopes.”}’
  • Access to Content Fragment data via API works as expected with the same credentials.
  • The technical account (API credentials) has been granted the required permissions in AEM.
  • The issue is specific to Persisted Query API requests, not general API access.

Cause

This error occurs because the access token generated via OAuth Server-to-Server credentials doesn’t include the required scope for accessing the Persisted Query API. This may be due to limitations in the available scopes for the technical account or the way the API is registered in the Adobe Developer Console.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Verify the API endpoint and access token usage:

    • Ensure you’re accessing the correct Persisted Query API endpoint (such as https://<author-instance>.adobeaemcloud.com/graphql/execute.json/<project>/<query>).

    • Confirm that the access token is generated for the correct technical account and environment.

  2. Check technical account permissions in AEM:

    • Verify that the technical account user is added to the appropriate AEM groups with permissions to access the required paths.

    • Ensure the api.yaml file with the correct client ID is deployed to the environment.

  3. Review and update scope configuration in the Adobe Developer Console:

    • In the Adobe Developer Console, open your project and API integration.

    • Check that all required scopes for the Persisted Query API are selected. If available, ensure scopes related to persisted queries are included.

    • If any required scopes are missing, edit the integration to add them, save changes, and re-download the updated service credentials (JSON file), if applicable.

    • Regenerate the access token using the updated credentials, and ensure the token request includes all required scopes.

    • Retry the API call using the new access token.

  4. If required scopes for persisted queries aren’t available in the Adobe Developer Console:

    • Use JWT credentials generated from the AEM Developer Console (not the Adobe Developer Console) for server-to-server APIs. These credentials aren’t deprecated and can be used for this use case.

    • Follow the AEM documentation to generate and use JWT credentials for API access.

  5. Troubleshooting tips:

    • Double-check the selected scopes in the Developer Console, and ensure the integration is correctly linked in the Admin Console.

    • If the error persists, review the API call, response, and configuration steps.

  6. If the issue is unresolved, refer to the official documentation or contact Adobe Support with details of your API call, response, and configuration steps taken.

recommendation-more-help
experience-cloud-kcs-help-kbarticles