# 403 Forbidden > The client is authenticated but does not have access rights to the content. Source: https://apiguide.dev/status-codes/403 Class: client-error Defined in: RFC 9110, Section 15.5.4 Updated: 2026-07-09 ## What does HTTP status code 403 mean? The 403 Forbidden status code indicates that the server understands the client's identity, but refuses to authorize access. ## When to use it in APIs Use 403 when an authenticated user attempts to access resources belonging to another tenant, or when a token lacks the required OAuth scopes (e.g., read-only token trying to write). ## How it compares to other codes * **401 Unauthorized**: Means the user's identity is unknown or invalid. 403 means their identity is known, but they lack access.