high

403 Forbidden

The server understood the request but refuses to authorize it. Authentication won't help — the user lacks permissions.

Common Causes

  1. 1Insufficient permissions/role
  2. 2IP address blocked
  3. 3CORS policy blocking the request
  4. 4Rate limit or WAF rule triggered

How to Fix

Check CORS configuration

// Server-side
res.setHeader('Access-Control-Allow-Origin', 'https://yourdomain.com');
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

Configure CORS headers if the 403 is caused by cross-origin requests.

How ObserveOne Helps

ObserveOne tracks permission errors and identifies misconfigured access policies.

Start Monitoring Free

Related Errors

401 Unauthorized

The request requires authentication. The client must provide valid credentials.

429 Too Many Requests

The client has sent too many requests in a given time period. The server is rate-limiting to protect itself.

400 Bad Request

The server cannot process the request due to malformed syntax, invalid parameters, or bad encoding.

404 Not Found

The server cannot find the requested resource. The URL may be wrong, the resource may have been deleted, or the route doesn't exist.

405 Method Not Allowed

The HTTP method (GET, POST, PUT, DELETE) is not supported for this endpoint.