HTTP Status Code for Authenticated but Unauthorized?

Question

With which HTTP status code should a REST API respond if the request is authenticated (according to The OAuth 2.0 Authorization Framework: Bearer Token Usage: Authorization Request Header Field) but the authenticated user is unauthorized to view the resource being requested?

For example, imagine I make a request to see a certain user's profile: GET /users/123. I authenticate successfully, but that user has blocked me. With which HTTP status code should the server respond?

Here's a useful guide for choosing an appropriate HTTP Status Code — Alex Marculescu
– Alex Marculescu, Commented Aug 26, 2016 at 8:32

Opal · Accepted Answer · 2016-08-26 08:59:28Z

3

The code you need is 403 Forbidden:

From wikipedia:

A 403 response generally indicates one of two conditions:

Authentication was provided, but the authenticated user is not permitted to perform the requested operation.

The operation is forbidden to all users. For example, requests for a directory listing return code 403 when directory listing has been disabled.

answered Aug 26, 2016 at 8:59

Opal

85.6k29 gold badges201 silver badges220 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

HTTP Status Code for Authenticated but Unauthorized?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related