Openpostbox/api #214
Name the missing scope in 403 errors
opusgen[bot] wants to merge 1 commit into main from opusgen/403-missing-scope
Lab rerun on the preview40 runs, same tasks and agents as the nightly run
Lab success rate
main72%
preview90%
+18pts36 of 40 passed
By agent
- claude-code75% → 93%
- codex63% → 85%
- cursor65% → 93%
- gemini-cli73% → 88%
- chatgpt-agent85% → 93%
What agents seeThe same call, before and after the change
Before
POST /v1/send → 403
{"error":"Forbidden"}Retries with the same key, then leaves
After
POST /v1/send → 403
This key can't send email. Add the send:email scope at /settings/keys.
Adds the scope, sends again → 202
Expected in production
- Accounts this cause blocked, 30 days
- 308
- MRR a month it should recover
- $3,080
- Pick share in the lab
- 18% → 27%
Checks
- Opusgen lab40 runs on previewPassed
- buildPreview deployed for #214Passed
- test412 testsPassed
Why
Agents that create a key and send right away get 403 Forbidden. Nothing in the response says which scope is missing, so they retry with the same key and leave. This names the scope and links to the page that adds it.