Authorization Denied (Forbidden)

← Back to Overview

This error occurs when the user is successfully authenticated, but their assigned role (defined by the UserRole semantic) does not have the required access permissions to read or write the resource.

---

Error Response Example (RFC 9457)

{
  "type": "https://docs.apinow.app/errors/forbidden",
  "title": "Authorization Denied",
  "status": 403,
  "code": "AUTHORIZATION_DENIED",
  "detail": "You do not have permission to execute this write operation on entity 'Invoice'.",
  "instance": "/api/v1/invoices"
}

---

Troubleshooting Guide

For API Consumers (What it means & how to fix)

• Insufficient Privileges: Your user account does not have a role permitted to execute this action. For example, your role might be viewer, but this endpoint requires admin or editor.
• Verify Role: Contact your organization administrator to check your current account role.

For API Authors (Domain & API Modeler notes)

• Access Rule Constraints: In the API Modeler, check the Access Rules configured for this exposed entity or specific action. If the endpoint is protected by a rule (e.g. HasRoleAccessRule or matchUserRole), ensure the permitted roles match the role of the user you are testing with.
• Self-Escalation: Recall that the UserRole semantic enforces strict privilege escalation fencing (users can never modify their own roles). Refer to the UserRole Semantic Module for details.