403 Forbidden JSON response example

Last updated 2026-05-20

When to use this

Use this for "you are logged in but cannot do this" — the user is authenticated but lacks the required role or permission. Include the missing permission so the UI can show a helpful message.

Example JSON

Returned when the user is authenticated but unauthorised for the resource.

{
  "status": 403,
  "error": "Forbidden",
  "message": "You do not have permission to perform this action",
  "code": "permission_denied",
  "requiredPermission": "products:write"
}

Request examples

const res = await fetch('https://jsonexamples.com/http/403/Forbidden');
if (!res.ok) {
  const err = await res.json();
  console.error(res.status, err.message);
}

curl -i https://jsonexamples.com/http/403/Forbidden

import requests

r = requests.get('https://jsonexamples.com/http/403/Forbidden')
if r.status_code >= 400:
    print(r.status_code, r.json())

Try the live endpoint

Click below to call /http/403/Forbidden from your browser.

// click the button to populate this block

Common variations

IP / region block

{
  "status": 403,
  "error": "Forbidden",
  "message": "Service not available in your region",
  "code": "geo_blocked"
}

Convert this JSON

Generated starting points for TypeScript, JSON Schema, and Zod. Refine before shipping to production.

export interface 403Forbidden {
  "status": number;
  "error": string;
  "message": string;
  "code": string;
  "requiredPermission": string;
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "403Forbidden",
  "type": "object",
  "properties": {
    "status": {
      "type": "integer"
    },
    "error": {
      "type": "string"
    },
    "message": {
      "type": "string"
    },
    "code": {
      "type": "string"
    },
    "requiredPermission": {
      "type": "string"
    }
  },
  "required": [
    "status",
    "error",
    "message",
    "code",
    "requiredPermission"
  ],
  "additionalProperties": false
}

import { z } from 'zod';

export const 403ForbiddenSchema = z.object({
  status: z.number(),
  error: z.string(),
  message: z.string(),
  code: z.string(),
  requiredPermission: z.string()
});
export type 403Forbidden = z.infer<typeof 403ForbiddenSchema>;