forbidden — Forbidden

What causes it

• The authenticated user is not the owner of the workflow (or of the execution's or batch's workflow) the request targets. Ownership checks run after scope checks and after the record lookup.
• A template lookup was made with a token whose API client has no user (an orphaned client).

How to fix it

1. Use the key belonging to the account that owns the cascade. Workflow and execution IDs are not shared across accounts.
2. Confirm the id with the list endpoint for the same key (`listWorkflows`, `listExecutions`, `listBatches`) before acting on it.

Operations that return it

• GET /workflows/{id} Show a workflow
• GET /workflows/{id}/test_cases List sandbox test cases for a workflow
• POST /workflows/{id}/trigger Trigger a workflow
• GET /workflow_templates/{id} Show a template (with definition)
• POST /workflows/{id}/batches Create a batch from N rows
• POST /batches/{id}/cancel Cancel a batch
• POST /batches/{id}/resume Resume an interrupted batch
• POST /batches/{id}/retry_failed Retry failed and skipped rows
• GET /batches/{id}/exports.csv Download flat results CSV
• GET /batches/{id}/exports.zip Download structured ZIP of batch results
• GET /batches/{id}/adverse_action_notices.zip Download all adverse-action notice PDFs as a ZIP
• GET /executions/{id} Show an execution
• POST /executions/{id}/cancel Cancel an execution
• POST /executions/{id}/re_evaluations Re-evaluate an execution
• POST /executions/{id}/review_decisions Approve or deny a paused review
• GET /executions/{id}/review_events List review audit events
• POST /executions/{id}/review_assignment Claim or unassign a review
• POST /executions/{id}/review_notes Append a review note
• POST /executions/review_bulk_actions Bulk approve / deny / assign_to_me
• GET /executions/{id}/report_artifacts List credit-report PDFs for an execution
• GET /executions/{id}/report_artifacts/{artifact_id} Download a credit-report PDF
• GET /executions/{id}/notice_artifacts List adverse-action notice PDFs for an execution
• GET /executions/{id}/notice_artifacts/{artifact_id} Download an adverse-action notice PDF

Example response

HTTP/1.1 403 Forbidden · Content-Type: application/json

{
  "error": {
    "code": "forbidden",
    "message": "You are not authorized to perform this action.",
    "details": [],
    "request_id": "6f1c2a3e-8d4b-4c5e-9f0a-1b2c3d4e5f60",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/forbidden"
  }
}