403 Forbidden

The server understood the request and knows who you are, but refuses to authorise it.

Last updated . How this page is checked.

Status code403
Status textForbidden
Category4xx Client Error
Response has bodyUsually
SpecificationRFC 9110

What does 403 Forbidden mean?

The server understood the request and knows who you are, but refuses to authorise it. It belongs to the 4xx Client Error class, which means the request contains bad syntax or cannot be fulfilled. Something about the request needs to change.

When do APIs return 403?

Authentication succeeded but the account lacks permission, the API key is missing a scope, or an IP allowlist or WAF rule blocked you.

How to fix a 403 Forbidden

This is a permissions problem, not a credentials problem — sending a fresh token will not help if the token lacks the required scope. Check the scopes attached to your key, the role of the authenticated user, and whether a firewall or geo rule is intercepting the request before it reaches the application.

Reproduce a 403 response

The fastest way to understand a status code is to trigger one and read the full response. Open the API tester and send a request to https://httpbin.org/status/403 — you will see the 403 status along with every response header the server sent. Comparing those headers against a working request is often what reveals the cause.

When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.

Related 4xx status codes

400 Bad Request

The server could not understand the request because it is malformed.

401 Unauthorized

The request lacks valid authentication credentials. Despite the name, this means unauthenticated.

402 Payment Required

The request cannot be processed until payment is made.

404 Not Found

The server cannot find the requested resource.

405 Method Not Allowed

The endpoint exists but does not support the HTTP method you used.

406 Not Acceptable

The server cannot produce a response matching the client's Accept header.

403 Forbidden FAQ

Why do I get 403 Forbidden when I am logged in?

Because being authenticated is not the same as being allowed. Your account or token lacks the permission, role or scope the action needs, or a rule such as an IP allowlist or a firewall is blocking the request.

Why would an API return 403 instead of 404?

To be explicit that the resource exists but you may not access it. Some APIs do the opposite and return 404 for resources you cannot see, so that the response does not confirm they exist.

Will retrying a 403 help?

No. Sending the same request with the same credentials gives the same answer. Something has to change first: the permissions on the account, the scopes on the token, or the rule that is blocking you.

See also

References