Posting my solution to this old topic for posterity. I had this issue until I went back and read what "Privilege Separation" means, again. With privilege separation enabled, only the permissions assigned to both the user and the api key will applied. So, I could (1) disable privilege separation for the key; or (2) assign the permissions to both the user that I had created as well as to the key that I had created for that user; or (3) recreate the key and assign the new key to a user with at least those permissions that I wanted (e.g. the root@pam user) and then assign only those privileges I wanted Zabbix to have to the key. For whatever reason, I chose option 3 and it got rid of the error..