Forbidden

What it means

The credentials are valid, but this account isn't allowed to do this.

This usually points at your integration's setup rather than anything the end user did. Show the end user a generic message like "Something went wrong on our end.", and log detail for your own debugging.

How to fix it

1. 1.

   The session user isn't a member of the target organization.

   Confirm X-Organization-Slug points at an org the logged-in user actually belongs to.

2. 2.

   The user has the Viewer role, and viewers can't perform write actions.

   Have an org admin change the user's role, or use an API token instead (tokens always have full access).

Where this happens

The ordinary organization-membership check shared by nearly every endpoint that requires the caller to belong to the organization.