Issue
PayPal returned result code 28 - Insufficient user permissions.

Cause
The username of the merchant who submitted the action doesn't have the privileges to execute it.

Solutions
How to resolve this error depends on what caused it:
 

Cause	Solution
A user with limited transactions privileges tried to issue a credit or refund with an API call.	Contact the administrator for the account and ask them to make the appropriate changes for the user.
A user tried to execute an UPDATEACTION on a result code 126 transaction through an API and doesn't currently have the proper permissions enabled on their account.	Contact Payflow Support to ask to have this feature implemented on your account. To enable this feature, send your request to enable transaction type “U” and your login ID by email to payflow-support@paypal.com. An admin user listed on the Payflow Pro account must submit this request.
A Payflow Link or PayPal Payments Advanced merchant tried to submit a Sale or Authorization transaction via API.	Payflow Pro merchants must use PayPal’s hosted checkout pages to process Sale and Authorization transactions. You should change your integration to use the hosted pages, or you can contact Payflow Support at 1-888-883-9770 and ask to have your account upgraded.

See also:
PayPal Payflow Pro API Credentials and Endpoints