---
title: forbidden — Forbidden
description: "HTTP 403 forbidden: You are not authorized to perform this action."
canonical_url: "https://cascades.crscreditapi.com/docs/api/errors/forbidden"
doc_version: "1.0.0"
last_updated: "2026-10-09T18:04:24Z"
http_status: 403
source: config/api_error_codes.yml
---

# `forbidden` — Forbidden

**HTTP 403 Forbidden**

Message: "You are not authorized to perform this action."

Envelope schema: `ErrorEnvelope` in [openapi.json](https://cascades.crscreditapi.com/openapi.json#/components/schemas/ErrorEnvelope) ([YAML](https://cascades.crscreditapi.com/openapi.yaml)).

## What causes it
- The authenticated user is not the owner of the workflow (or of the execution's or batch's workflow) the request targets. Ownership checks run after scope checks and after the record lookup.
- A template lookup was made with a token whose API client has no user (an orphaned client).

## How to fix it
1. Use the key belonging to the account that owns the cascade. Workflow and execution IDs are not shared across accounts.
2. Confirm the id with the list endpoint for the same key (`listWorkflows`, `listExecutions`, `listBatches`) before acting on it.

## Operations that return it
- [GET /workflows/{id}](/docs/api/workflows/get-workflow) — Show a workflow
- [GET /workflows/{id}/test_cases](/docs/api/workflows/list-workflow-test-cases) — List sandbox test cases for a workflow
- [POST /workflows/{id}/trigger](/docs/api/workflows/trigger-workflow) — Trigger a workflow
- [GET /workflow_templates/{id}](/docs/api/workflow-templates/get-workflow-template) — Show a template (with definition)
- [POST /workflows/{id}/batches](/docs/api/batches/create-batch) — Create a batch from N rows
- [POST /batches/{id}/cancel](/docs/api/batches/cancel-batch) — Cancel a batch
- [POST /batches/{id}/resume](/docs/api/batches/resume-batch) — Resume an interrupted batch
- [POST /batches/{id}/retry_failed](/docs/api/batches/retry-failed-batch) — Retry failed and skipped rows
- [GET /batches/{id}/exports.csv](/docs/api/batches/export-batch) — Download flat results CSV
- [GET /batches/{id}/exports.zip](/docs/api/batches/export-batch-zip) — Download structured ZIP of batch results
- [GET /batches/{id}/adverse_action_notices.zip](/docs/api/batches/download-batch-adverse-action-notices) — Download all adverse-action notice PDFs as a ZIP
- [GET /executions/{id}](/docs/api/executions/get-execution) — Show an execution
- [POST /executions/{id}/cancel](/docs/api/executions/cancel-execution) — Cancel an execution
- [POST /executions/{id}/re_evaluations](/docs/api/executions/re-evaluate-execution) — Re-evaluate an execution
- [POST /executions/{id}/review_decisions](/docs/api/executions/submit-review-decision) — Approve or deny a paused review
- [GET /executions/{id}/review_events](/docs/api/executions/list-review-events) — List review audit events
- [POST /executions/{id}/review_assignment](/docs/api/executions/assign-review) — Claim or unassign a review
- [POST /executions/{id}/review_notes](/docs/api/executions/add-review-note) — Append a review note
- [POST /executions/review_bulk_actions](/docs/api/executions/bulk-review-actions) — Bulk approve / deny / assign_to_me
- [GET /executions/{id}/report_artifacts](/docs/api/executions/list-report-artifacts) — List credit-report PDFs for an execution
- [GET /executions/{id}/report_artifacts/{artifact_id}](/docs/api/executions/get-report-artifact) — Download a credit-report PDF
- [GET /executions/{id}/notice_artifacts](/docs/api/executions/list-notice-artifacts) — List adverse-action notice PDFs for an execution
- [GET /executions/{id}/notice_artifacts/{artifact_id}](/docs/api/executions/get-notice-artifact) — Download an adverse-action notice PDF

## Example response

```http
HTTP/1.1 403 Forbidden
Content-Type: application/json
```

```json
{
  "error": {
    "code": "forbidden",
    "message": "You are not authorized to perform this action.",
    "details": [],
    "request_id": "6f1c2a3e-8d4b-4c5e-9f0a-1b2c3d4e5f60",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/forbidden"
  }
}
```

[All error codes](https://cascades.crscreditapi.com/docs/api/errors.md)

## Sitemap

See the full [sitemap](https://cascades.crscreditapi.com/sitemap.md) for all pages.