I have a REST call to mysite/_api/web/webs, I get a successful response, but if i remove permission from mysite/subsite01/ I get a 403, even if I have access to mysite/subsite02/ mysite/subsite03/. I am making the call from a publishing page on /mysite/ so I am confused as to why this would be the case, surely it should return the list of subsites, but just not include subsite01
/_api/web/webs only works for users who have manage web or above permissions on the site collection i.e you need to be either a site collection owner or Site collection admin for this endpoint to work.
If you try with a visitor or member permission, it wont work. Its a common issue.
To get around it, you need to use
/_api/web/getsubwebsfilteredforcurrentuser(nwebtemplatefilter=-1,nconfigurationfilter=0) endpoint and make a
GET request. It will give you permission trimmed list of sites you have access to.
Reference - Webs REST API reference