Skip to content

Forbidden

URI: https://docs.ankatech.co/errors/forbidden
HTTP Status: 403 Forbidden

When you see this

You are authenticated but do not have permission to perform the requested operation or access the specified resource.

Common Causes

  • Account Activation Required: Your administrator account requires password activation before login. This occurs when a tenant was provisioned with account activation enabled. You must use the activation token provided during provisioning to set your password via POST /api/v1/public/activate-account.
  • Your credentials (API key, token, or session) are valid but lack the required role or scope.
  • You attempted an operation not allowed by key lifecycle policy (e.g. trying to sign with an expired key).
  • You tried to access another user's or tenant's resource without proper authorization.
  • You invoked an endpoint restricted to admins or specific service accounts.

Response Example

{
  "type": "https://docs.ankatech.co/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "Access is denied.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/keys",
  "timestamp": 1751500800,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 7807 Problem Details. The example above is an Admin API body, where the correlation identity is extensions.requestId; the Core API and the PQC Handshake API instead emit a top-level correlationId. Read the member your service emits — see Error Index & Overview.

403 is deliberately NOT relayed across an internal service boundary. When an internal upstream refuses the platform's own service-to-service credential, the caller reports Upstream Service Unavailable (502) instead — a platform-side condition must never reach you as if it were a decision about your authorization. See S2S Relay Envelope.

How to Resolve

For Account Activation Required:

  1. Locate the activation token provided when your tenant was provisioned.
  2. Call POST /api/v1/public/activate-account with:
    • token: Your activation token (single-use, 24-hour expiration)
    • newPassword: Your new password (minimum 12 characters with complexity requirements)
  3. After successful activation, login normally with your new password.

For Permission Issues:

  1. Verify you are using the correct API credentials and that they have the necessary roles/scopes.
  2. Check the resource's ownership or tenancy—ensure your token is scoped to that project or key.
  3. Review the API's authorization requirements in the documentation.
  4. If you believe you should have access, contact your administrator to request the necessary permissions.

If you continue to receive a 403 error after these steps, please consult the full Developer Hub Reference.