> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Forbidden project

# `forbidden_project`

| HTTP | When                                                                                                |
| ---- | --------------------------------------------------------------------------------------------------- |
| 403  | The token is valid for the workspace, but the acting principal cannot access the requested project. |

Project access follows the same rules as the dashboard: an OAuth
principal whose user is not a workspace admin only reaches the projects
they are individually assigned to.

The same code refuses a user whose workspace role is **Client**
(an agency's customer) on everything the dashboard withholds from that
role: every write and most reads. Those refusals carry
`details.reason: "client_role"` and `details.area` naming what was
refused; nothing on the integration side can recover them, because the
restriction is the role itself. See
[OAuth §5.1](../oauth.md#51-client-accounts-get-the-dashboards-client-view).

For a project refusal, either have a workspace admin assign the user to the
project, or operate on a project the principal already reaches
(`GET /v1/projects` lists exactly those).

Note that most cross-workspace probes return
[`not_found`](./not_found.md) rather than this code — the API never
confirms the existence of resources outside your reach.