diff --git a/.changeset/rest-401-403-semantics.md b/.changeset/rest-401-403-semantics.md
new file mode 100644
index 0000000000000..682e1abae59d4
--- /dev/null
+++ b/.changeset/rest-401-403-semantics.md
@@ -0,0 +1,18 @@
+---
+'@rocket.chat/meteor': major
+---
+
+**Breaking:** the REST API no longer answers `401 Unauthorized` for authorization failures. A 401 now means one thing only — the request carries no valid session.
+
+Every `error-unauthorized` / `error-not-authorized` throw in the codebase follows an authorization check (`hasPermissionAsync`, `canAccessRoom`, `canDeleteFile`, agent department scope), never a missing session, but the error switch in `server/api/ApiClass.ts` mapped `error-unauthorized` to 401 while the permission middleware answered 403 for the very same condition. A client could not infer session state from the status code, which is what logged out live sessions in the `sendMessage` / `getReadReceipts` migration.
+
+Status code changes:
+
+- `error-not-authorized` / `not-authorized` — the dominant permission code, previously unmapped and falling through to `API.v1.failure()`: **400 → 403**.
+- `error-unauthorized` / `unauthorized`: stays **403**, and no longer flips to 401.
+- `rooms.membersOrderedByRole` (broadcast member list), `rooms.hide`, `rooms.bannedUsers` — returned 401 for access and permission failures: **401 → 403**. Their response schemas now declare it.
+- Routes declaring `permissionsRequired` without `authRequired`, called with no session: **403 → 401**.
+
+Also removed a dead `if (applyBreakingChanges)` fork in the permissions middleware whose two branches were identical.
+
+The unauthenticated side is unchanged here: those checks still throw `error-invalid-user` and answer 400. Splitting them out needs a dedicated error code, since `error-invalid-user` also means "that user does not exist", and is tracked separately.
diff --git a/apps/meteor/server/api/ApiClass.ts b/apps/meteor/server/api/ApiClass.ts
index 71dfc86bc0020..e1c54b24d1be8 100644
--- a/apps/meteor/server/api/ApiClass.ts
+++ b/apps/meteor/server/api/ApiClass.ts
@@ -898,11 +898,12 @@ export class APIClass<TBasePath extends string = '', TOperations extends Record<
 								switch (e.error) {
 									case 'error-too-many-requests':
 										return api.tooManyRequests(typeof e === 'string' ? e : e.message);
+									// every `error-unauthorized`/`error-not-authorized` throw in the codebase follows an authorization check,
+									// so they map to 403; 401 is reserved for a missing or invalid session
 									case 'unauthorized':
 									case 'error-unauthorized':
-										if (applyBreakingChanges) {
-											return api.unauthorized(typeof e === 'string' ? e : e.message);
-										}
+									case 'not-authorized':
+									case 'error-not-authorized':
 										return api.forbidden(typeof e === 'string' ? e : e.message);
 									case 'forbidden':
 									case 'error-forbidden':
diff --git a/apps/meteor/server/api/v1/middlewares/permissions.ts b/apps/meteor/server/api/v1/middlewares/permissions.ts
index 41412321605f8..767dd2293ddc1 100644
--- a/apps/meteor/server/api/v1/middlewares/permissions.ts
+++ b/apps/meteor/server/api/v1/middlewares/permissions.ts
@@ -2,7 +2,6 @@ import { Logger } from '@rocket.chat/logger';
 import type { Method } from '@rocket.chat/rest-typings';
 import type { MiddlewareHandler } from 'hono';
 
-import { applyBreakingChanges } from '../../ApiClass';
 import { API } from '../../api';
 import { type PermissionsPayload, checkPermissionsForInvocation } from '../../api.helpers';
 import type { TypedOptions } from '../../definition';
@@ -20,13 +19,8 @@ export const permissionsMiddleware =
 		const user = c.get('user');
 
 		if (!user) {
-			if (applyBreakingChanges) {
-				const unauthorized = API.v1.unauthorized('You must be logged in to do this');
-				return c.json(unauthorized.body, unauthorized.statusCode);
-			}
-
-			const failure = API.v1.forbidden('User does not have the permissions required for this action [error-unauthorized]');
-			return c.json(failure.body, failure.statusCode);
+			const unauthorized = API.v1.unauthorized('You must be logged in to do this');
+			return c.json(unauthorized.body, unauthorized.statusCode);
 		}
 
 		let hasPermission: boolean;
@@ -43,13 +37,8 @@ export const permissionsMiddleware =
 		}
 
 		if (!hasPermission) {
-			if (applyBreakingChanges) {
-				const forbidden = API.v1.forbidden('User does not have the permissions required for this action [error-unauthorized]');
-				return c.json(forbidden.body, forbidden.statusCode);
-			}
-
-			const failure = API.v1.forbidden('User does not have the permissions required for this action [error-unauthorized]');
-			return c.json(failure.body, failure.statusCode);
+			const forbidden = API.v1.forbidden('User does not have the permissions required for this action [error-unauthorized]');
+			return c.json(forbidden.body, forbidden.statusCode);
 		}
 
 		return next();
diff --git a/apps/meteor/server/api/v1/rooms.ts b/apps/meteor/server/api/v1/rooms.ts
index b73339de453b0..026d75660cca4 100644
--- a/apps/meteor/server/api/v1/rooms.ts
+++ b/apps/meteor/server/api/v1/rooms.ts
@@ -1134,6 +1134,7 @@ API.v1.get(
 			}),
 			400: validateBadRequestErrorResponse,
 			401: validateUnauthorizedErrorResponse,
+			403: validateForbiddenErrorResponse,
 			404: validateNotFoundErrorResponse,
 		},
 	},
@@ -1152,7 +1153,7 @@ API.v1.get(
 		}
 
 		if (findResult.broadcast && !(await hasPermissionAsync(this.user, 'view-broadcast-member-list', findResult._id))) {
-			return API.v1.unauthorized();
+			return API.v1.forbidden();
 		}
 
 		// Ensures that role priorities for the specified room are synchronized correctly.
@@ -1292,13 +1293,14 @@ API.v1.post(
 			200: successResponseSchema,
 			400: validateBadRequestErrorResponse,
 			401: validateUnauthorizedErrorResponse,
+			403: validateForbiddenErrorResponse,
 		},
 	},
 	async function action() {
 		const { roomId } = this.bodyParams;
 
 		if (!(await canAccessRoomIdAsync(roomId, this.userId))) {
-			return API.v1.unauthorized();
+			return API.v1.forbidden();
 		}
 
 		const user = await Users.findOneById(this.userId, { projection: { _id: 1 } });
@@ -1695,13 +1697,14 @@ export const roomEndpoints = API.v1
 			response: {
 				200: roomsBannedUsersResponseSchema,
 				401: validateUnauthorizedErrorResponse,
+				403: validateForbiddenErrorResponse,
 			},
 		},
 		async function action() {
 			const { roomId } = this.queryParams;
 
 			if (!(await canAccessRoomIdAsync(roomId, this.userId))) {
-				return API.v1.unauthorized();
+				return API.v1.forbidden();
 			}
 
 			const { offset, count } = await getPaginationItems(this.queryParams);
diff --git a/apps/meteor/tests/end-to-end/api/rooms.ts b/apps/meteor/tests/end-to-end/api/rooms.ts
index af7de96de5e50..395e1d697b48e 100644
--- a/apps/meteor/tests/end-to-end/api/rooms.ts
+++ b/apps/meteor/tests/end-to-end/api/rooms.ts
@@ -4663,7 +4663,7 @@ describe('[Rooms]', () => {
 				.set(nonMemberCredentials)
 				.send({ roomId: roomB._id })
 				.expect('Content-Type', 'application/json')
-				.expect(401)
+				.expect(403)
 				.expect((res) => {
 					expect(res.body).to.have.property('success', false);
 				});
@@ -5101,6 +5101,27 @@ describe('[Rooms]', () => {
 			await Promise.all(bannedUsers.map((user) => deleteUser(user)));
 		});
 
+		it('should return forbidden if user does not have access to the room', async () => {
+			const privateRoom = (await createRoom({ type: 'p', name: `banned-users-private-${Date.now()}-${Math.random()}` })).body.group;
+			const nonMember = await createUser({ joinDefaultChannels: false });
+			const nonMemberCredentials = await login(nonMember.username, password);
+
+			try {
+				await request
+					.get(api('rooms.bannedUsers'))
+					.set(nonMemberCredentials)
+					.query({ roomId: privateRoom._id })
+					.expect('Content-Type', 'application/json')
+					.expect(403)
+					.expect((res) => {
+						expect(res.body).to.have.property('success', false);
+					});
+			} finally {
+				await deleteRoom({ type: 'p', roomId: privateRoom._id });
+				await deleteUser(nonMember);
+			}
+		});
+
 		it('should list every banned user of the room with only the projected fields', async () => {
 			const res = await request
 				.get(api('rooms.bannedUsers'))