forbidden

forbidden

Description

The caller is authenticated, but lacks the permission required by the endpoint.

HTTP Status

403 Forbidden

doc_url Format

The doc_url value is an absolute URL and changes by environment:

<docs-base-url>/errors/forbidden

Typical Causes

• The access token is valid, but does not include the permission required for the route.
• A restricted-access middleware rejected the caller (INSUFFICIENT_ROLES).
• A required identity claim is absent from the token (the API response does not indicate which claim is missing).

Example

Response:

{
  "errors": [
    {
      "code": "forbidden",
      "message": "INSUFFICIENT_ROLES",
      "doc_url": "https://docs.example.com/errors/forbidden"
    }
  ]
}

How To Fix

1. Sign in with an account that has the required permission.
2. Check that endpoint's authentication requirements in the API reference and align your identity provider configuration with what that route expects.
3. Retry the request with a token that satisfies the access rule for that operation.