title: WSO2 apim server responds successfully even a user doesn't have corresponding role to an api
body: <p>I followed the steps mentioned in the below WSO2 documentation to set up WSO2 Identity Server as a Key Manager for Api Manager</p>
  <p><a href="https://apim.docs.wso2.com/en/latest/install-and-setup/setup/distributed-deployment/configuring-wso2-identity-server-as-a-key-manager/" rel="nofollow noreferrer">https://apim.docs.wso2.com/en/latest/install-and-setup/setup/distributed-deployment/configuring-wso2-identity-server-as-a-key-manager/</a></p>
  <p>I can access the carbon admin console in both the WSO2 IS and WSO2 APIM (in two servers)</p>
  <p><a href="https://host.apim.com/carbon/admin/login.jsp" rel="nofollow noreferrer">https://host.apim.com/carbon/admin/login.jsp</a> and <a href="https://host.iskm.com/carbon/admin/login.jsp" rel="nofollow noreferrer">https://host.iskm.com/carbon/admin/login.jsp</a></p>
  <p>I think, in normal cases if a user &quot;USER1&quot; got an access token with certain rights and he/she is able to access corresponding APIs. In my case, once the USER1 generates an access token, it is able to invoke another APIs even he/she doesn't have appropriate role to it.</p>
  <p>Assume USER1 has a SERVICE_ROLE1 role to access SERVICE_API1 api. In devportal USER1  created an application and subscribed to the SERVICE_API1. After generating the access token, USER1 is able to call the SERVICE_API1 with that. The problem is, USER1 is able to call for instance SERVICE_____API77 with that token as well. How is it possible?</p>
  <p>I would like that to work as for instance if a user invokes an api for which he/she doesn't have access/role it should say something like Resource forbidden.</p>