An Astra DB application token with the Database Manager role can manage databases but cannot create them through the DevOps API. Agents that provision infrastructure with a least-privilege token get permission errors on database creation and often misread it as a malformed request. The terraform-provider-astra docs spell out the minimums: "The Astra provider assumes the token has a minimum permission of either Database Manager for database actions and/or Organization Administrator for the streaming actions." Creating a database is an org-level action, so provisioning code needs a token with Organization Administrator. Split your tokens by job: an Organization Administrator token for provisioning databases, and a Database Manager (or narrower) token for runtime data-plane access.