401 Unauthorized during Sketch API resource access

When integrating with the Sketch REST API, authentication is managed via an API token passed in the Authorization header. While requests missing a token consistently return a 401 Unauthorized response, there is uncertainty regarding the API's behavior when a token is syntactically valid but lacks the necessary permissions for a specific resource.

The goal is to distinguish between a complete authentication failure and a scoped permission deficiency during integration testing in a development workspace.

• Does the Sketch API return a 401 Unauthorized or a 403 Forbidden when a valid token lacks specific resource permissions?
• Is the error payload consistent across different endpoints when encountering these permission-based failures?