# Circleci api returns "permission denied" **URL:** \ **Category:** API\ **Tags:** api\ **Created:** [March 26, 2021, 10:56am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558 "2021-03-26T10:56:31Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![MrHjalmarsson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mrhjalmarsson/32/27027_2.png) [@MrHjalmarsson](https://discuss.circleci.com/u/MrHjalmarsson)\ **Post date:** [March 26, 2021, 10:56am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/1 "2021-03-26T10:56:31Z")
I’m trying to get, add and delete environment variables with the Circleci API with curl. I’ve created a personal API token and made sure that I’ve the correct role in Github (owner). The response for `curl -u https://circleci.com/api/v1.1/me` is working fine. The following is also working fine `curl -u https://circleci.com/api/v1.1/project/github/username/projectname` I have no trouble to list all projects. But when I try to do anything (get, add, delete) with environment variables I get the response ‘Permission denied’. For example when calling `curl -u https://circleci.com/api/v1.1/project/github/username/projectname/envvar` or `curl -u https://circleci.com/api/v1.1/project/github/username/projectname/envvar/nameofvar` etc… I’m having a hard time figuring out what I’m doing wrong. I can edit the env vars in the CircleCI ui so it’s weird I can’t do it here. Any ideas? Thanks ---
**Author:** ![yannCI](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/yannci/32/24866_2.png) [@yannCI](https://discuss.circleci.com/u/yannCI)\ **Post date:** [March 26, 2021, 1:49pm UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/2 "2021-03-26T13:49:07Z")
Hi @MrHjalmarsson, Welcome to the CircleCI community! Do the environment variables in question appear in the UI on the _“Project Settings \> Environment Variables”_ page ([https://app.circleci.com/settings/project/github/username/projectname/environment-variables](https://app.circleci.com/settings/project/github/username/projectname/environment-variables))? If so, is the username returned by `curl -u : https://circleci.com/api/v1.1/me` the one you’re logged into the UI as? ---
**Author:** ![MrHjalmarsson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mrhjalmarsson/32/27027_2.png) [@MrHjalmarsson](https://discuss.circleci.com/u/MrHjalmarsson)\ **Post date:** [March 29, 2021, 8:00am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/3 "2021-03-29T08:00:17Z")
Hi @yannCI! Thanks for replying! Yes the variables is present in the UI and yes the correct user is returned ---
**Author:** ![yannCI](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/yannci/32/24866_2.png) [@yannCI](https://discuss.circleci.com/u/yannCI)\ **Post date:** [March 29, 2021, 1:27pm UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/4 "2021-03-29T13:27:07Z")
Hi @MrHjalmarsson, I was able to reproduce this behaviour in 2 different ways: 1. By using a project API token with a **non-Admin** scope. 2. By using a project API token generated under another project. Either way, I suspect the API token you’re using is a [project token](https://circleci.com/docs/2.0/managing-api-tokens/#creating-a-project-api-token) rather than a [personal token](https://circleci.com/docs/2.0/managing-api-tokens/#creating-a-personal-api-token). Is the token you’re using listed under [https://app.circleci.com/settings/user/tokens](https://app.circleci.com/settings/user/tokens)? Or under the [https://app.circleci.com/settings/project/github/username/projectname/api](https://app.circleci.com/settings/project/github/username/projectname/api)? In the latter case, is the scope set to “ **Admin** ”? If so, are you using this token to send API requests for the same project? ---
**Author:** ![MrHjalmarsson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mrhjalmarsson/32/27027_2.png) [@MrHjalmarsson](https://discuss.circleci.com/u/MrHjalmarsson)\ **Post date:** [March 29, 2021, 1:46pm UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/5 "2021-03-29T13:46:33Z")
Hi @yannCI! I’ve made sure (and tested again now) that I’m either using a personal token or using a project token with scope ‘Admin’ under the correct project. Both returns permission denied when calling /envar, but fine for /me or /username/projectname etc. I’ve also made sure that I have admin rights in github. ---
**Author:** ![yannCI](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/yannci/32/24866_2.png) [@yannCI](https://discuss.circleci.com/u/yannCI)\ **Post date:** [March 29, 2021, 6:23pm UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/6 "2021-03-29T18:23:20Z")
Thanks for the prompt reply, @MrHjalmarsson! I also reproduced the behaviour by using a personal API token from a user who hasn’t access to the GitHub repository. As you confirmed the token you use was generated for a user who has sufficient access in GitHub, I suspect permissions in CircleCI and GitHub are out of sync. Could you try [refreshing permissions](https://support.circleci.com/hc/en-us/articles/360048210711-How-to-Refresh-User-Permissions)? If the issue persists after that, please [perform a full re-authentication](https://support.circleci.com/hc/en-us/articles/360051228052-How-to-perform-a-full-re-authentication). Let me know how it goes. ---
**Author:** ![MrHjalmarsson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mrhjalmarsson/32/27027_2.png) [@MrHjalmarsson](https://discuss.circleci.com/u/MrHjalmarsson)\ **Post date:** [March 30, 2021, 7:18am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/7 "2021-03-30T07:18:39Z")
@yannCI, thanks for replying! I’ve tried both to refresh permission and performed a full re-authentication but no success. Can still get all user and project details but no access to /envvar. Could it have something to do with that my user is listed as an organization in the “ORGANIZATIONS” tab in the left header? I see following in that tab: Organizations GH GH ---
**Author:** ![yannCI](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/yannci/32/24866_2.png) [@yannCI](https://discuss.circleci.com/u/yannCI)\ **Post date:** [March 30, 2021, 10:47am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/8 "2021-03-30T10:47:05Z")
@MrHjalmarsson, At this stage, I need to look further into your CircleCI account information. Could you please [open a Support request](https://support.circleci.com/hc/en-us/requests/new) and reference this CircleCI Discuss post? ---
**Author:** ![MrHjalmarsson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mrhjalmarsson/32/27027_2.png) [@MrHjalmarsson](https://discuss.circleci.com/u/MrHjalmarsson)\ **Post date:** [March 30, 2021, 11:32am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/9 "2021-03-30T11:32:32Z")
Yes, sure! Thank you for helping out, @yannCI! ---
**Author:** ![yannCI](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/yannci/32/24866_2.png) [@yannCI](https://discuss.circleci.com/u/yannCI)\ **Post date:** [March 30, 2021, 11:46am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/10 "2021-03-30T11:46:51Z")
Ticket received! Thanks @MrHjalmarsson. I’m working on it. ---
**Author:** ![MrHjalmarsson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mrhjalmarsson/32/27027_2.png) [@MrHjalmarsson](https://discuss.circleci.com/u/MrHjalmarsson)\ **Post date:** [March 30, 2021, 11:57am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/11 "2021-03-30T11:57:36Z")
@yannCI , Thanks! ---
**Author:** ![yannCI](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/yannci/32/24866_2.png) [@yannCI](https://discuss.circleci.com/u/yannCI)\ **Post date:** [May 17, 2021, 10:53am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/12 "2021-05-17T10:53:06Z")
👋 Hi @MrHjalmarsson, Closing the loop in this thread in case another user encounters the same situation. It appeared that: - There were two separate projects with the same name under two organizations - You were using the project API token generated for `organization_1/the_project` in the API call related to `organization_2/the_project` Hence the `permissions denied` response. Once again, I’d like to thank you for your commendable cooperation and patience throughout the investigation. Happy building! 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\ **Post date:** [May 27, 2021, 10:53am UTC](https://discuss.circleci.com/t/circleci-api-returns-permission-denied/39558/13 "2021-05-27T10:53:54Z")
Closed on May 27, 2021, 10:53am UTC This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.