HTTP 403 Forbidden

The server understood the request but refuses to fulfill it; valid authentication credentials do not necessarily change the outcome.

Use 403 when the server will not authorize the requested action, whether because of permissions, policy, or another deliberate access decision.

httpstatus codeauthauthorization

Response (http)

HTTP/1.1 403 Forbidden

Use 403 when the server will not authorize the requested action, whether because of permissions, policy, or another deliberate access decision.

Common mistakes

Retrying authentication against a 403; valid credentials will not change the outcome.

Registry reference: RFC9110, Section 15.5.4

Sources