403Forbidden
The server understood the request, knows who you are, and is refusing anyway. Authenticating again will not help.
Browse all HTTP status codesWhen you see it
Permissions, most of the time: a valid account without the right role, an API key lacking a scope, or a resource belonging to someone else.
On a website it is also a common file-permissions error, where the web server process cannot read a file on disk, or directory listing is disabled and no index file exists.
What to do about it
Check permissions before credentials, because a 403 has already accepted your identity. For an API, confirm the key has the scope the endpoint requires. For a site you host, check the file permissions and ownership of the path being requested.
A 403 where you expected a 404 is sometimes deliberate. Revealing that a resource exists but is off limits leaks information, so some servers hide private resources behind 404 instead.
Often confused with
401 Unauthorized
401 means you have not proved who you are and doing so may work. 403 means you have, and it changed nothing. If logging in again fixes it, it should have been a 401.
404 Not Found
Some servers return 404 for forbidden resources on purpose, so that the existence of a private resource is not revealed to someone who cannot access it.
Look up another one
Open
Type a code, a partial code like 40, or any word from a name or description. Everything runs in your browser.
69 of 69 codes. Click a row to copy it.