mbs api: raise forbidden errors as needed