---
name: Registry-ts_scope
title: Why am I getting errors about insufficient scope in Container Registry?
description: You have a valid IAM API key or OAuth token, but you still get `Access denied` errors about insufficient scope in IBM Cloud® Container Registry.
last-updated: 2026-04-15
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/Registry?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why am I getting errors about insufficient scope in Container Registry?
{: #troubleshoot-scope}
{: troubleshoot}
{: support}

You have a valid IAM API key or OAuth token, but you still get `Access denied` errors about insufficient scope in IBM Cloud® Container Registry.
{: shortdesc}

When you try to access Container Registry, you get the following message:
{: tsSymptoms}

`Insufficient scope`

You might see this message if you're trying to access Container Registry by using a client such as Docker. The following alternatives are possible causes:
{: tsCauses}

- **Scenario A.** The API key that is used to access Container Registry has insufficient permissions.
- **Scenario B.** Context-based restriction rules are in place.

You can fix this problem in the following ways:
{: tsResolve}

- **Scenario A.** Confirm that the API key that you are using has suitable permissions for the resource that you are trying to access. Contact the owner of the resource for help. For more information, see [Managing IAM access](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&interface=ui&format=markdown).

- **Scenario B.** Check whether context-based restriction rules are in place. If so, these rules prevent you from accessing resources outside the defined allowed contexts. Adjust the allowed context or rerun your pull from within an allowed context. For more information, see [Protecting Container Registry resources with context-based restrictions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry-cbr&interface=ui&format=markdown).

    To confirm whether a context-based restriction rule caused the `Access denied` error, check the instance of IBM Cloud Logs that is configured to receive events from IBM Cloud Activity Tracker Event Routing for the resource that is being accessed. For more information, see [Determining how enabled rules affect access](https://cloud.ibm.com/docs/iam?topic=iam-cbr-monitor&format=markdown#enabled-access).
    {: tip}