Hi and welcome back!

Have you seen this topic where a related issue has been discussed?
I believe this problem could also be caused by the UI/UX.

Missing scopes: model.request on restricted API key Bugs

This turned out to be poor UX design. If you first set “Model Capabilities” to “Request”, then unset any permissions you don’t want it works correctly. In both cases it shows “Mixed” for that…