Error: forbidden
The request was authenticated but the caller lacks permission for the operation.
What it means
403 fires when a valid credential exists but isn't allowed to do what was asked — e.g. a non-admin key hitting an admin-only route, or a cross-tenant access attempt.
Common causes
Agent-scoped keys calling admin endpoints.
Resolving or deleting rules that belong to another agent.
Badge or dashboard routes hit from an untrusted origin.
How to fix
Use a key with the right scope (admin token for admin routes).
Confirm the rule or approval belongs to the calling agent.
At a glance
| Field | Value |
|---|---|
| HTTP status | 403 |
| Error code | forbidden |
| Response shape | {"error": "forbidden"} |
| Auth state | Valid credential, wrong scope |
Example
curl -X DELETE https://sipi.bot/api/rules/rul_abc -H "Authorization: Bearer <agent-key-of-another-agent>"
HTTP/1.1 403
{"error": "forbidden"}Scope the key correctly or use the admin token.
FAQ
Is forbidden the same as invalid_api_key?
No. invalid_api_key means the credential is bad. forbidden means the credential is valid but lacks permission.
Can I get 403 on evaluate?
Evaluate is anonymous-capable and doesn't return 403 under normal use. 403s are for control-plane permission problems.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check