Skip to main content
2026-07-29 16:01
REST API

403 Forbidden

ErrorAuthValidateEasy
Try Interactive Demo

What you will learn

  • 403 means authenticated but not authorised — different from 401 (unauthenticated)
  • Avoid leaking resource existence — 403 for a hidden resource tells an attacker it exists
  • Test role-based access: per-role × per-endpoint matrix catches permission holes

Description

Handle insufficient permissions for authenticated user.

Test Scenario

const response = await request.delete('/api/v1/admin/settings', {
  headers: { 'Authorization': 'Bearer ' + userToken }
});
expect(response.status()).toBe(403);
Endpoint/api/v1/errors/403

Testing Tips

  • •Valid auth but no permission
  • •Different from 401 (authenticated but forbidden)
  • •Check error explains restriction
// Playwright API Testing - REST
import { test, expect } from '@playwright/test';


test('REST API request', async ({ request }) => {
  const response = await request.get('/api/v1/resource');


  expect(response.ok()).toBeTruthy();
  expect(response.status()).toBe(200);


  const data = await response.json();
  expect(data).toBeDefined();
});

Challenge ID: rest-error-403

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/errors/403

Press Enter to send