HTTP 403 — Forbidden
HTTP 403 draws the permission line: the server knows who you are, but this account may not do that. Unlike 401, re-authenticating changes nothing — the identity is fine, the authorisation is not.
When 403 shows up
- Role-gated endpoints an authenticated user has no right to call.
- IP or WAF rules blocking a request outright.
Mocking a 403 response
A response with this status can be faked end to end with a local mock rule — no backend changes needed. The configuration below mirrors the rule fields the ApiSimul editor uses (method, path, status, delay in milliseconds, response body):
{
"method": "GET",
"path": "/api/admin/settings",
"status": 403,
"delay": 150,
"enabled": true,
"body": {
"error": "forbidden",
"requiredRole": "admin"
}
}Dynamic placeholders such as {{random.name}}, {{string.uuid}} or {{number.int 1 100}} can appear inside the body to vary each response, which keeps client-side list rendering and retry logic honest during development.
Frequently asked questions
What does HTTP 403 mean?
The server refuses to authorise the request regardless of retrying. The body may or may not explain the reason; the status alone means "no".
How can I test a 403 response without a real backend?
Define a mock rule with the method and path your client requests and set the status to 403. The example configuration above returns this response after the listed delay, so the client exercises its 403 handling exactly as it would against a live server.
Related status codes
Need the response in your own project? Spin up rules for any status with the ApiSimul mock server, or browse every status code page.