The server knows who you are and is refusing anyway. Authentication succeeded; authorization did not.
The 401-versus-403 distinction is the single most common auth bug. Test the same endpoint with no token, a valid read-only token and an admin token, and assert all three.
22 endpoints in this playground answer with 403. Every one is free, needs no signup, and can be called from the browser or with curl.
POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Viewer token not allowed (Friends API)DELETE https://funapi.dev/api/friends/v1/characters/{id} — Viewer token not allowed (Friends API)DELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Viewer token not allowed (Superhero API)DELETE https://funapi.dev/api/football/v1/teams/{id} — Viewer token not allowed (Football API)DELETE https://funapi.dev/api/movies/v1/movies/{id} — Viewer token not allowed (Movies API)DELETE https://funapi.dev/api/wizarding/v1/students/{id} — Viewer token not allowed (Harry Potter API)DELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Viewer token not allowed (Star Wars API)DELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Viewer token not allowed (Sherlock Holmes API)DELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — Viewer token not allowed (Pokémon API)DELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — Viewer token not allowed (Middle-earth API)DELETE https://funapi.dev/api/webhooks/v1/subscriptions/{id} — Viewer token not allowed (Webhooks API)DELETE https://funapi.dev/api/office/v1/employees/{id} — Viewer token not allowed (The Office API)DELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — Viewer token not allowed (Dino Park API)DELETE https://funapi.dev/api/marvel/v1/heroes/{id} — Viewer token not allowed (Marvel API)POST https://funapi.dev/api/got/v1/nobles/{id}/kill — Viewer token not allowed (Game of Thrones API)DELETE https://funapi.dev/api/rickandmorty/v1/characters/{id} — Viewer token not allowed (Rick and Morty API)POST https://funapi.dev/api/bank/v1/accounts/{id}/freeze — Viewer token not allowed (Bank API)DELETE https://funapi.dev/api/airline/v1/bookings/{id} — Viewer token not allowed (Airline API)DELETE https://funapi.dev/api/protocol/v1/documents/{id} — Viewer token not allowed (Protocol Lab API)POST https://funapi.dev/api/space/v1/launches/{id}/launch — Viewer token cannot push the big red button (Space Agency API)DELETE https://funapi.dev/api/starfleet/v1/crew/{id} — Viewer token not allowed (Starfleet API)POST https://funapi.dev/api/starfleet/v1/tribbles/purge — Viewer token not allowed (Starfleet API)All HTTP status codes · All 37 mock REST APIs · Getting started guide