A button/action is missing because of role or API-key scope
CanvasRelay enforces permissions on the server; hiding a control is often the UI reflection of the current owner/admin/editor/viewer role or API-key scopes.
What you may be seeing
- A teammate cannot edit/manage an area, or an API-key session can read but not write.
What usually causes it
- The user's organization role lacks the action.
- An API key was minted without the required scope.
- Some sensitive actions require a session sign-in/owner role rather than an API-key connection.
Do this
- Open Settings → Team and confirm the user's role.
- Owners/admins can grant the minimum appropriate role; do not make someone owner just to solve an unrelated editing problem.
- For API integrations, inspect the key's scope chips. Mint a new appropriately scoped key if needed; a key's raw value cannot be recovered later.
- For account-only settings, sign in with the user session rather than expecting an API-key connection to manage personal account state.
You know it is fixed when
- The user/key has the required scope/role and the action succeeds without CR-1004.
Search phrases this guide covers
permission denied · CR-1004 · button missing · viewer can't edit · API key scope
