# User Token does not match expected privileges

**URL:** <https://discuss.hashicorp.com/t/user-token-does-not-match-expected-privileges/75629>\
**Category:** HCP Terraform\
**Created:** [June 30, 2025, 4:13am UTC](https://discuss.hashicorp.com/t/user-token-does-not-match-expected-privileges/75629 "2025-06-30T04:13:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![enpicie](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/enpicie/32/45995_2.png) [@enpicie](https://discuss.hashicorp.com/u/enpicie)\
**Post date:** [June 30, 2025, 4:13am UTC](https://discuss.hashicorp.com/t/user-token-does-not-match-expected-privileges/75629/1 "2025-06-30T04:13:49Z")

</div>

According to [API Tokens documentation](https://developer.hashicorp.com/terraform/cloud-docs/users-teams-organizations/api-tokens#access-levels), User Tokens should be allowed to modify the org. I have a user token created from [https://app.terraform.io/app/settings/tokens](https://app.terraform.io/app/settings/tokens) for the user who is the organization owner for the org i am using. With this user I can modify the org and create org variable sets in HCP Terraform.

I am using `curl` to check the privileges for this token. When i check `curl -H "Authorization: Bearer <user_token>" https://app.terraform.io/api/v2/organizations/<my_org>`, I get a successful response.

When I check `curl -H "Authorization: Bearer <user_token>" https://app.terraform.io/api/v2/organizations/<my_org>/variable-sets`, I get a 404.

When i try to execute a run for a config that uses `tfe_variable_set` to try creating an org variable set in my org, the apply fails both on runs triggered via UI and via my GitHub Actions pipeline. The error is “Error: Error creating variable set \<var\_set\_name\>, for organization: \<my\_org\>: resource not found”

There is a disparity in expectations here. Why can I create variable sets in the UI and navigate the whole org in it using my user, but I cannot see anything but the org details with the user token for my user? Why does my actual privileges not match what is documented? How should I go about resolving this so I can have a token that I can use to create variable sets instead of having to create and manage them manually?