HTTP status code 403 — Forbidden
Quick answer
Status code 403 (Forbidden): Authenticated but not allowed. Permissions/ACL issue — different from 401.
Permissions/ACL issue — different from 401.
403 means the server understood who you are (or refuses to say) and still denies access. Check roles, scopes, and resource ACLs.
Common causes
- Authenticated user lacks the required role/permission
- IP allowlist or WAF rule blocking the request
- CORS preflight denied by the server
How to fix it
Check the account/token's role or scope — re-authenticating will not help if the account itself lacks permission.
Related: 404401405400408409308307
Frequently asked questions
What is status code 403?
403 Forbidden: Authenticated but not allowed. Permissions/ACL issue — different from 401.
When should I expect HTTP 403?
403 means the server understood who you are (or refuses to say) and still denies access. Check roles, scopes, and resource ACLs.
What usually causes HTTP 403?
Authenticated user lacks the required role/permission; IP allowlist or WAF rule blocking the request; CORS preflight denied by the server.
How do I fix HTTP 403?
Check the account/token's role or scope — re-authenticating will not help if the account itself lacks permission.
Where can I see all status codes?
Open the HTTP status codes hub on TryDevSnip for the full reference list.
Does TryDevSnip log my API traffic?
No. These pages are static reference. TryDevSnip does not proxy or inspect your HTTP calls.