Forbidden

Server perspective

Use 403 when the request is understood but the client is not allowed to perform it, even with current authentication.

When to use

• •Return 403 for permission, policy, geographic, or account-state restrictions
• •Use it when the client is known but the action is still not allowed
• •User lacks required permissions or roles
• •Resource access restricted by policy
• •Geographic or IP-based restrictions
• •Account suspended or disabled

How to respond

• •Explain the policy or permission problem briefly when it is safe to do so
• •Consider 404 instead when revealing the resource would create an information leak

Headers to consider

• •No status-specific header is required; still send normal HTTP metadata such as Content-Type, caching, or tracing headers when they help the client.

Response body

• •Optionally include a machine-readable reason such as insufficient_scope or account_suspended

Server-side pitfalls

• •Do not use 403 when authentication is missing or refreshable; use 401 instead
• •Do not assume re-authentication alone will fix a true 403
• •Authentication required (use 401 Unauthorized)
• •Resource doesn't exist (use 404 Not Found)
• •Bad request format (use 400 Bad Request)

Examples