forbidden_project

Project access follows the same rules as the dashboard: an OAuth principal whose user is not a workspace admin only reaches the projects they are individually assigned to.

The same code refuses a user whose workspace role is Client (an agency's customer) on everything the dashboard withholds from that role: every write and most reads. Those refusals carry details.reason: "client_role" and details.area naming what was refused; nothing on the integration side can recover them, because the restriction is the role itself. See OAuth §5.1.

For a project refusal, either have a workspace admin assign the user to the project, or operate on a project the principal already reaches (GET /v1/projects lists exactly those).

Note that most cross-workspace probes return not_found rather than this code — the API never confirms the existence of resources outside your reach.