When using mashup with Qlik Sense SaaS, API requests done in the mashup that require Admin or Developer roles fail with a 403 (Forbidden) error.
Environments:
Qlik Sense Business
Qlik Cloud
Resolution
This is a product limitation. For security reasons "Admin" and "Developer" roles are automatically stripped off in CORS mode, therefore it's not possible to perform any actions requiring those roles in a mashup.
For example, requesting an API key from a mashup will fail as this requires the Developer role.