Why do I get a permission error when I try to start a scan?

Why this happens

Several gates stand between you and a running scan. Your role must hold scan:run. The profile must sit inside your group scope. And the workspace needs room to run it. A permission error points to the first two, while a message about limits or a missing repository points somewhere else, so read the wording before you ask anyone for a new role.

How to fix it

1. Ask an admin whether your role holds scan:run. Without it, the Scan action fails even though you can open the profile.
2. Check that you can see the profile on Scan Profiles. When a group limits your access, profiles outside it stay out of reach.
3. Read the message closely. "No repository configured — add a Git repository URL to run a scan." is a profile problem, not a permission one.
4. Open Settings → Plan & usage and check Scans this month and Scans at once. Full limits are a different case from a denied role.
5. Try again.
6. Or have an admin run it for you while you sort out the role.

Pipelines use their own key. A scan started by CI needs ci:trigger, and it runs with the token owner's permissions and group scope. Read why CI cannot trigger a scan for that route, and note that full limits show up differently from a refused permission.

Still not working?

• Check how to start a scan to be sure you start from the right place.
• Check API permission errors if the call comes from a script.

Send us the profile name, the exact message and your role through the contact page.

Related questions

• How do I start a scan?
• Why won't a new scan start while others are already running?
• My CI job can't trigger a scan. What should I check?
• Why does my API call return a permission error?
• Which permissions can I give a custom role?

Full tutorial

How to run a pentest scan in Cyberlop, and what happens next

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre