403 Forbidden
You are authenticated but not allowed to do this.
What it means
The server understood who you are and refused the action, for example a missing scope or role.
What your client should do
Request the needed permission or scope. Re-authenticating with the same identity will not help.
Should you retry?
Only after you change the request.
Security angle
Some APIs return 404 instead of 403 so they do not confirm that a protected resource exists.
Try it
The free practice API returns this status on demand, with the headers a well-behaved API would send. Call GET /api/play/status/403 from Endpoint Client and open the Explain tab.
Related codes
401 Unauthorized
Authentication is missing or invalid.
404 Not Found
No resource exists at this URL (or you may not see it).
Defined in RFC 9110. All status codes and headers