// Client error
403 Forbidden
The server understood the request but refuses to fulfill it. Repeating the same credentials usually does not help.
Common causes
- The caller lacks the required permission.
- A workspace key targets a different workspace.
- A resource or network policy denies access.
Troubleshooting
- Inspect permission assignments and resource scope.
- Distinguish missing authentication (401) from denied access.
- Check server policy before retrying; a 403 alone does not prove an IP allowlist problem.
HTTP example
POST /payments HTTP/1.1
Host: api.example.com
Authorization: Bearer <token>
Content-Type: application/json
{"amount":4900,"currency":"EUR"}
HTTP/1.1 403 Forbidden
Content-Type: application/json
Cache-Control: no-store
{"code":"permission_denied","message":"Payment creation is not allowed"}Related status codes
// GET STARTED
Inspect the complete API response.
Use REST Test to send a request and review its status, headers, timing and body together.