Forbidden

Overview

403 Forbidden means the server understood the request but refuses to authorize it. Unlike 401, the identity may be authenticated, but that identity lacks permission (authorization) for this resource, so re-logging in will not help.

Typical causes are insufficient role/permissions, an IP/geo/firewall (WAF) block, a missing OAuth scope, or attempting to access another user's resource. The server is effectively saying, "I know who you are, but this action is not allowed."

When it happens

• It is returned when an authenticated user attempts an admin-only action their role does not permit.
• It occurs when a WAF or IP/geo rule blocks the request, or the token lacks a required OAuth scope.

Request / Response example

DELETE /api/orgs/9/members/17 HTTP/1.1
Host: api.example.com
Authorization: Bearer valid.token.for.viewer

HTTP/1.1 403 Forbidden
Content-Type: application/json

{"error":"forbidden","message":"Your role 'viewer' cannot remove members"}

In code

app.delete('/api/orgs/:o/members/:m', (req, res) => {
  if (req.user.role !== 'admin')
    return res.status(403).json({ error: 'forbidden' });
  // ...
});

@app.delete('/orgs/<int:o>/members/<int:m>')
def remove(o, m):
    if current_user.role != 'admin':
        abort(403)
    return '', 204

Notes

• To hide a resource's very existence, a server may deliberately return 404 instead of 403 to minimize information disclosure.
• When credentials are absent or expired, 401 is correct rather than 403 — confusing the two is a common API design mistake.
• For content blocked on legal grounds, 451 Unavailable For Legal Reasons is more specific than 403.

Related status codes

Specification