HTTP 403 Forbidden indicates the server understood the request but refuses to fulfill it. Unlike 401 Unauthorized (which is about missing/invalid authentication), 403 means the server knows who you are but you don't have permission to access this resource. Re-authenticating won't help — the denial is based on authorization policy, not identity verification.
Response includes the status code, standard headers (including Content-Type), and a small diagnostic JSON body describing the request and returned status.
Simulator URL (copy in the app after load — not a normal link):
https://httpstatus.com/api/status/403
Example request:
curl -i "https://httpstatus.com/api/status/403"The request was valid, but the server is refusing action.
On this code, Inspector focuses on semantics, headers, and correctness warnings that commonly affect clients and caches.
HTTP 403 Forbidden has specific technical implications for API design, caching, and client behavior. Understanding the precise semantics helps distinguish it from similar status codes and implement correct error handling. The response should include a descriptive body following a consistent error schema (like RFC 7807 Problem Details) so clients can programmatically handle the error.
// Handle 403 Forbidden in Express
app.use((err, req, res, next) => {
if (err.status === 403) {
return res.status(403).json({
type: 'https://api.example.com/errors/forbidden',
title: 'Forbidden',
status: 403,
detail: err.message
});
}
next(err);
});from fastapi import HTTPException
# Raise 403 Forbidden
raise HTTPException(
status_code=403,
detail={
'type': 'forbidden',
'message': 'Descriptive error for 403 Forbidden'
}
)// Spring Boot 403 Forbidden handling
@ExceptionHandler(CustomForbiddenException.class)
public ResponseEntity<ErrorResponse> handleForbidden(
CustomForbiddenException ex) {
return ResponseEntity.status(403)
.body(new ErrorResponse("Forbidden", ex.getMessage()));
}// Return 403 Forbidden
func errorHandler(w http.ResponseWriter, message string) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(403)
json.NewEncoder(w).Encode(map[string]any{
"status": 403,
"error": "Forbidden",
"message": message,
})
}