403 Forbidden
The server understood the request and refuses to fulfil it. Unlike 401, sending different credentials will not help.
At a glance
- Status code
- 403 Forbidden
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 9110
- Cacheable by default
- yes
- Response body
- May explain why, or may deliberately not.
In detail
Authorisation failed, or the action is simply not permitted here. The server is not asking for credentials, it is declining.
Use 403 when the caller is known and not allowed. Some systems return 404 instead to avoid confirming that the resource exists, which is a deliberate information-leak tradeoff rather than a mistake.
Check the specific permission, not just the role. Most 403s in practice come from a scope missing on a token that is otherwise valid.
Examples
HTTP/1.1 403 Forbidden
Content-Type: application/json
{"error":"missing scope: orders:write"}Things that catch people out
- 403 is cacheable by default. A 403 stored by a shared cache while a permission was being provisioned will keep being served after the permission is granted.
- Web application firewalls return 403 for requests they consider hostile. An unexplained 403 on a request that looks fine is often a firewall rule matching on a payload string.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →401 Unauthorized
The request lacks valid credentials. Despite the name, this is about authentication (who you are), not authorisation (what you may do).
404 Not Found
The server has no representation for this URL and will not say whether it ever did. The most common status code on the web after 200.
405 Method Not Allowed
The URL exists but does not support the method you used. The Allow header lists the methods it does support.
406 Not Acceptable
The server cannot produce a representation that matches the Accept headers the client sent.
407 Proxy Authentication Required
A proxy between the client and the server needs credentials. This is 401 raised by the intermediary rather than by the origin.
408 Request Timeout
The server gave up waiting for the client to finish sending the request and closed the idle connection.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL