forbidden_project
Project access follows the same rules as the dashboard: an OAuth
principal whose user is not a workspace admin only reaches the projects
they are individually assigned to.
The same code refuses a user whose workspace role is Client
(an agency’s customer) on everything the dashboard withholds from that
role: every write and most reads. Those refusals carry
details.reason: "client_role" and details.area naming what was
refused; nothing on the integration side can recover them, because the
restriction is the role itself. See
OAuth §5.1.
For a project refusal, either have a workspace admin assign the user to the
project, or operate on a project the principal already reaches
(GET /v1/projects lists exactly those).
Note that most cross-workspace probes return
not_found rather than this code — the API never
confirms the existence of resources outside your reach.