Hey Monica!
Are you sure that your request contains a pipeline_id param? It is required, and if it's not there then the API will not know which pipeline (and thus forbid you from doing the call)

The json body should be something like: { "pipeline_id": abc123, "prospects": { ... } }

If this is the case I will revisit that error since it's confusing since it should really probably be a 400 error.

Hi Houston,
Thanks for the quick response. That was indeed the issue and your comment helped us debug the issue. Turns out there were two issues made it difficult to debug:
1. pipeline_id needed to be at the top level of the request, not nested inside prospects. We had been sending {"prospects": {"pipeline_id": id, ...}} which returned 403 rather than a helpful 400, so your suggestion to check for 400 instead is a good one.

2. The prospects object needed org data in an organizations array (e.g. {"name": "Org Name"}), not an organization_id field referencing an existing record. This wasn't obvious from the docs.
Here's the format of the json that finally worked, in case anyone else runs into the same issue:
 {"pipeline_id": id, "stage": "Stage", "prospects": {"organizations": [{"name": "Org Name"}]}}