OCAPI permissions are configured againstresource IDs, not against one particular inventory-list identifier embedded in an individual request. In the example URL, the principal API resource family isinventory_lists;ecom-inventoryis merely the identifier of the particular inventory list being accessed.
Therefore, the developer should inspect the OCAPI Data API settings for a resource rule covering theinventory_listsresource path, such as an appropriate/inventory_lists/...pattern, and verify that the required HTTP method and attribute selectors have been permitted.
Theclient_ididentifies the external application whose permissions are being evaluated, but it does not identify the inventory API resource being enabled. Similarly,ecom-inventoryis instance/business data and should not be confused with the API resource family.
This distinction is central to OCAPI authorization. A client configuration associates a client ID with resource path patterns, allowed HTTP methods, andread_attributes/write_attributesselectors. Requests are authorized only when they match an enabled resource and method.
Study Guide reference:Application Development — OCAPI Data API, inventory-list resources, resource IDs, client permissions, HTTP methods, and inventory integrations.
===============
