403 Forbidden

I know exactly who you are. No.

What it properly means

The client does not have access rights to the content, so the server refuses. Unlike 401, the client's identity is known.

Class
4xx Client error: you fucked up
Defined in
RFC 9110, section 15.5.4

Get one yourself

This endpoint really answers with 403. Point your client at it and see what it does.

curl -i https://httpcodes.dev/api/403

People mix this up with

  • 401 Unauthorized403

    Not logged in, or not allowed?

    401 means the server doesn't know who you are: log in and try again. 403 means it knows exactly who you are and the answer is still no, so logging in again won't help.

  • 403404 Not Found

    Forbidden, or pretending it is not there?

    403 admits the thing exists but refuses to hand it over. 404 says there is nothing here, and servers also use it to hide things from people who are not allowed to know they exist.