---
url: /errors/forbidden.md
---
# `forbidden`

`forbidden`

## Description

The caller is authenticated, but lacks the permission required by the endpoint.

## HTTP Status

`403 Forbidden`

## `doc_url` Format

The `doc_url` value is an absolute URL and changes by environment:

`<docs-base-url>/errors/forbidden`

## Typical Causes

* The access token is valid, but does not include the permission required for
  the route.
* A restricted-access middleware rejected the caller (`INSUFFICIENT_ROLES`).
* On `GET /v1/authentication/subjects/{externalUserId}`, Quarzo recognizes the
  caller, but the caller is not a Broker Service Account
  (`BROKER_MACHINE_IDENTITY_NOT_FOUND`).
* A required identity claim is absent from the token (the API response does not
  indicate which claim is missing).
* On `POST /v1/catalog/products`, the authenticated user does not have the
  `catalog:product:write` permission.

## Example

Response:

```json
{
  "errors": [
    {
      "code": "forbidden",
      "message": "INSUFFICIENT_ROLES",
      "doc_url": "https://docs.example.com/errors/forbidden"
    }
  ]
}
```

## How To Fix

1. Sign in with an account that has the required permission.
2. Check that endpoint's authentication requirements in the
   [API reference](/api/) and align your identity provider configuration with
   what that route expects.
3. Retry the request with a token that satisfies the access rule for that
   operation.