The server knows who you are and is refusing anyway. Authentication succeeded; authorization did not.
Defined in RFC 9110 §15.5.4 — 403 Forbidden · MDN reference
A reader trying to write, a tenant reaching for another tenant's data, a request from a blocked region, a valid token missing a scope.
The 401-versus-403 distinction is the single most common auth bug. Test the same endpoint with no token, a valid read-only token and an admin token, and assert all three.
Do not retry, and do not re-authenticate — the credential is fine. Re-authenticating on a 403 is a common and costly bug: it turns a clean permission error into a login storm. Show the user what they lack, or fail the operation.
24 endpoints in this playground answer with 403. Every one is free, needs no signup, and can be called from the browser or with curl.
POST https://funapi.dev/api/friends/v1/characters/bulk-delete — Viewer token not allowed (Friends API) Open & run this endpointDELETE https://funapi.dev/api/friends/v1/characters/{id} — Viewer token not allowed (Friends API) Open & run this endpointDELETE https://funapi.dev/api/superheroes/v1/heroes/{id} — Viewer token not allowed (Superhero API) Open & run this endpointDELETE https://funapi.dev/api/football/v1/teams/{id} — Viewer token not allowed (Football API) Open & run this endpointDELETE https://funapi.dev/api/movies/v1/movies/{id} — Viewer token not allowed (Movies API) Open & run this endpointDELETE https://funapi.dev/api/wizarding/v1/students/{id} — Viewer token not allowed (Harry Potter API) Open & run this endpointDELETE https://funapi.dev/api/galaxy/v1/characters/{id} — Viewer token not allowed (Star Wars API) Open & run this endpointDELETE https://funapi.dev/api/holmes/v1/suspects/{id} — Viewer token not allowed (Sherlock Holmes API) Open & run this endpointDELETE https://funapi.dev/api/pokemon/v1/pokemon/{id} — Viewer token not allowed (Pokémon API) Open & run this endpointDELETE https://funapi.dev/api/middleearth/v1/fellowship/{id} — Viewer token not allowed (Middle-earth API) Open & run this endpointDELETE https://funapi.dev/api/webhooks/v1/subscriptions/{id} — Viewer token not allowed (Webhooks API) Open & run this endpointDELETE https://funapi.dev/api/office/v1/employees/{id} — Viewer token not allowed (The Office API) Open & run this endpointDELETE https://funapi.dev/api/dinopark/v1/dinosaurs/{id} — Viewer token not allowed (Dino Park API) Open & run this endpointDELETE https://funapi.dev/api/marvel/v1/heroes/{id} — Viewer token not allowed (Marvel API) Open & run this endpointPOST https://funapi.dev/api/got/v1/nobles/{id}/kill — Viewer token not allowed (Game of Thrones API) Open & run this endpointDELETE https://funapi.dev/api/rickandmorty/v1/characters/{id} — Viewer token not allowed (Rick and Morty API) Open & run this endpointPOST https://funapi.dev/api/bank/v1/accounts/{id}/freeze — Viewer token not allowed (Bank API) Open & run this endpointDELETE https://funapi.dev/api/airline/v1/bookings/{id} — Viewer token not allowed (Airline API) Open & run this endpointDELETE https://funapi.dev/api/protocol/v1/documents/{id} — Viewer token not allowed (Protocol Lab API) Open & run this endpointPOST https://funapi.dev/api/space/v1/launches/{id}/launch — Viewer token cannot push the big red button (Space Agency API) Open & run this endpointDELETE https://funapi.dev/api/starfleet/v1/crew/{id} — Viewer token not allowed (Starfleet API) Open & run this endpointPOST https://funapi.dev/api/starfleet/v1/tribbles/purge — Viewer token not allowed (Starfleet API) Open & run this endpointPUT https://funapi.dev/api/fiba/v1/teams/{id}/staff — Viewer token not allowed (FIBA World Cup API) Open & run this endpointPOST https://funapi.dev/api/fiba/v1/games/{id}/simulate — Viewer token not allowed (FIBA World Cup API) Open & run this endpointAll HTTP status codes · All 39 mock REST APIs · Getting started guide
Last updated