# 403 permission_error: check organization and workspace access
Authentication succeeded and authorization failed. Your request shape is probably fine.
## What to do
1. Check the organization's access and workspace settings in the Claude Console. Keys can be scoped to workspaces and roles; the resource you called may sit outside the key's scope.
2. Confirm you are calling the right endpoint for your product surface. Some endpoints are restricted to specific tiers or admin roles.
3. If the key recently changed roles or the workspace settings changed, that is your cause. Revert or re-grant.
4. Retry policy: a 403 never clears by waiting. Change the access, then retry once.
## The trap
Reading a 403 as "my request is malformed" and rewriting working code. The request was understood and refused. Also the reverse of the 401 trap: regenerating a key fixes 401s, never 403s, because the new key inherits the same lack of permission.
## Checklist
- 401: who are you (key problem). 403: not you (access problem). Say it out loud before debugging.
- When a previously working call starts 403ing, check Console access settings first. Something changed on the account side.