Case 2: Cracking it with Simulation Environment

Case 2: Meridian Travel. A customer's API key works for contacts but gets a 403 on the reports endpoint. I reproduce the error, work out that the key is missing the reports:read scope, and write the reply to the customer.