Error 403 when I try to update shipment status

I use APP_KEY and combined secret (md5($shop['token'].APP_SECRET)) for authentication.

When I try to update shipment status I receive error 403:

'The server understood the request but is refusing to fulfill it: No "update" permission to "orders" using this key.'

Here is the URL where I send PUT request:

https://APP_KEY:[email protected]/en/shipments/10121887.json

Payload: {"status":"cancelled"}

Shop ID: 643580

App permissions: