Forbidden

Identifiers

Field	Value
Type URI	https://echo.labstack.com/pro/problems/forbidden
Code	forbidden
HTTP status	403

HTTP status	English title
403	Forbidden

When it occurs

The application refused the request under its authorization policy. It returns this code only for a refusal it knows is an authorization decision.

Client handling

Do not retry with the same credentials. Ask for the required permission, or use an account that has it.

Example response

If your application installs a custom handler, the body may differ.

HTTP/1.1 403 Forbidden
Content-Type: application/problem+json

{
  "code": "forbidden",
  "status": 403,
  "title": "Forbidden",
  "type": "https://echo.labstack.com/pro/problems/forbidden"
}

Server correction

Fix the scope, tenant membership or resource permission that caused the refusal. Select an allowed tenant and a resource owned by it.

Response fields

Your application (problem.NewError)

• type (string, always): The exact type URI above.
• title (string, always): The catalog title in the rendered language: English by default, Japanese only when the application selects it.
• status (integer, always): The HTTP status of the response.
• code (string, always): The stable code above.
• detail (string, optional): Display text that your application sets, up to 256 bytes with problem.NewError. Omitted when you set none.

Headers:

• Cache-Control (conditional): no-store, set by problem/echoadapter.
• Content-Language (conditional): en or ja, set by problem/echoadapter from its configured language.

Notes:

• The adapter keeps existing WWW-Authenticate, Allow and Retry-After headers and adds no challenge or retry advice of its own.
• On HEAD, the adapter’s Content-Length equals the GET body’s length.

Related behavior

See the problem catalog for application error handling.