What does HTTP status code 403 mean?
The 403 Forbidden status code indicates that the server understands the client’s identity, but refuses to authorize access.
When to use it in APIs
Use 403 when an authenticated user attempts to access resources belonging to another tenant, or when a token lacks the required OAuth scopes (e.g., read-only token trying to write).
How it compares to other codes
- 401 Unauthorized: Means the user’s identity is unknown or invalid. 403 means their identity is known, but they lack access.
