403 “Forbidden” when calling api/v1/Opportunity with API-Key user (Docker 9.1.5)

[office]

Hi everyone,

• Stack: EspoCRM 9.1.5, official espocrm/espocrm:fpm Docker image behind Nginx proxy.
• API User: type = API, auth = API-Key, no Roles yet.
• Goal: pull Opportunity data for external analytics.
• Request:
  bash
  CopyEdit
  curl -H "X-Api-Key: c2aad9add9b99548d93a2cd82da36ac2" \ "https://imunizareclimatica.eu/api/v1/Opportunity?select=id,name&maxSize=1"
• Result: {"error":"Forbidden"} → HTTP 403.
• Tried:
  • API key is active, user is active.
  • Works when I switch to basic auth with an Admin token.
• Question: which minimal Role/ACL flags are required for an API key to READ Opportunities (and later Leads, Accounts)? And is there an EspoCLI command to assign the role instead of clicking in the UI?

Thanks in advance!