403 reading organization members or roles: the caller lacks org:sys_memberships:read

TL;DR: Membership and role API calls 403 for some users but work for admins. The endpoint requires a system permission most members do not have. Confirm the cause 1. Check the caller's membership role in the dashboard and whether that role carries the needed system permission.

The fix

1. Reading memberships and roles requires the org:sys_memberships:read (or manage) system permission on the caller's membership. Plain members do not have it.
2. Check the caller's membership role in the dashboard and whether that role carries the needed system permission.
3. UI components that list members (like the organization switcher/profile) trigger these calls; they 403 for under-permissioned members rather than returning empty.
4. Gate member-listing UI on a has() check for the permission, so members never see a broken control.
5. Or make the call from your backend with the secret key instead of the user's session, and enforce your own access rule.

When to use this

• This covers exactly what the title says: 403 reading organization members or roles.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with 403; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current 403 behavior.

Verified 2026-09-26: the @clerk changelog documents that organization role queries require org:sysmemberships:read or org:sysmemberships:manage and 403 without them; community debugging tables map 'Insufficient permissions' to checking the has() call against the dashboard permission string.