Automation Answers

Why Am I Getting a 403 Forbidden API Error?

A 403 Forbidden error means the API knows who you are but blocks the request: missing scopes, roles, plan limits, IP rules, or record-level permissions.

By Automation Ace Editorial Team · Reviewed for technical accuracy by Troy Tessalone · Published · Updated

Short answer

Why Am I Getting a 403 Forbidden API Error?

A 403 Forbidden response means the API accepted your credentials but refuses this action. The connected identity is missing a scope, role, or plan feature, or a rule blocks it. Read the error body, compare the connected user's permissions with the endpoint's requirements, then reauthorize with the scopes you need or run the step as an account that has access.

Common causes

  • The OAuth token was granted without a scope the endpoint needs, such as write access or admin access.
  • The connected user's role cannot see or edit this workspace, base, folder, or record.
  • The feature or endpoint is only available on a higher plan or needs an add-on.
  • An IP allowlist, firewall, bot protection, or regional restriction blocks the automation platform's servers.
  • An admin has disabled API access or third-party apps for the organization.

Diagnostic steps

  1. Read the full response body. Many APIs name the missing scope or permission.
  2. Sign in to the app as the connected user and try the same action by hand. If you can't do it there, the automation can't either.
  3. Compare the scopes or token permissions on the connection with the scopes the endpoint's documentation lists, then reconnect and approve the missing ones.
  4. Check admin settings for API, IP, and third-party app restrictions. Ask the app owner to allow the integration if you can't change them.
  5. Retest the smallest read request first, then the write request, so you can tell an access problem from a payload problem.

Example

A Zap can read Airtable records but gets a 403 when it creates one. The personal access token only has the data.records:read scope. Adding data.records:write and access to that base fixes it.

Caveats

A 401 means the credential itself is missing or invalid. A 403 means the credential works but isn't allowed to do this. Some APIs return 404 instead of 403 to hide records you can't see, so check permissions when a known record shows as not found. Give the connection only the scopes it needs, never more.