Nope. The API uses the exact same user permissions as the GUI. If the user account can transition the issue to that state in the GUI, then their account can transition to that state via the REST API.
I think you have a more fundamental problem. Something like the id of the transition is wrong or some other aspect of the request itself is wrong. Do some testing with a test tool like Postman first, to confirm the raw request is valid.
Also, apart from getting a 403 error, what is the body of the error message itself?