Partner says the dataset API is forbidden. Their user can log on to TSO.

A partner can sign on to TSO and still gets forbidden on a dataset read. What should we check first?

Check the identity the API presents, and whether that identity can read this dataset. Catalog search and content reads succeed or fail as that RACF user. TSO access is not the same statement. Also separate a forbidden response from a missing dataset and from a file that is exclusively open. Those are different errors and they point at different owners.