Hi,

I'm testing Railway API mutations and running into a persistent issue: my personal API tokens can create services but cannot delete them. The serviceDelete mutation is consistently rejected with "Not Authorized" even after generating a fresh personal token.

Setup:

Project: gracious-luck (375daff1-6138-4a59-a5c3-a7ee9f4867b9)

Environment: development (90dc4434-8e5c-40a9-af76-ff99305cf3ec)

Token type: Personal account token

What works:

✅ Token auth and API reachability

✅ Project/environment/service reads

✅ serviceCreate mutation (verified with throwaway services)

✅ All other mutations introspect successfully

What fails:

❌ serviceDelete mutation → "Not Authorized"

Steps taken:

Tried two different personal API tokens (regenerated the second)

Confirmed tokens are personal account tokens (not workspace/team tokens)

Confirmed serviceDelete is available in the schema and properly typed

The tokens can read everything and create services, but deletions are blocked at the API level. I can delete services manually from the Dashboard without issue, suggesting this is an API-specific restriction, not an account-level block.

Is this a known limitation, or is there a workspace-level setting I'm missing that blocks API-based deletions?

Feature request: A way to scope/restrict API token permissions (e.g., read-only, create-only, specific mutation allowlists) would make automation much safer and more auditable.