Access Management API returns 403 Forbidden when retrieving team group mappings — requires view:access_controls (Access Control Viewer) permission

Description

Customers integrating via a Connected App (Client Credentials grant) or user token may call GET .../organizations/{orgId}/teams/{teamId}/groupmappings to retrieve group access mappings for a team. Without a role that includes view:access_controls, the call returns 403 Forbidden. It's a fine-grained, Anypoint-Platform-managed permission (as opposed to Salesforce-managed coarse-grained permissions like "Access Anypoint Platform").

Resolution

1. Identify the calling identity (user ID from Admin Console, or the Connected App's associated identity).
2. Retrieve its current roles/permissions: GET /accounts/api/users/{userId}/roles?limit=1000&offset=0&role_groups=true
3. Check if any assigned role includes view:access_controls.
4. If missing, assign a role containing view:access_controls in Access Management.
5. Retry the groupmappings call.