Great answer, the problem was this: `Parent API key must allow only

documents:search

action` I feel that should be documented somewhere. Or I completely missed it. But thanks so much for your response.