CODEWITHSUNDEEP
restapihttphttp-status-code-403http-status-code-401
ma11hew28
ma11hew28

Reputation: 126507

HTTP Status Code for Authenticated but Unauthorized?

With which HTTP status code should a REST API respond if the request is authenticated (according to The OAuth 2.0 Authorization Framework: Bearer Token Usage: Authorization Request Header Field) but the authenticated user is unauthorized to view the resource being requested?

For example, imagine I make a request to see a certain user's profile: GET /users/123. I authenticate successfully, but that user has blocked me. With which HTTP status code should the server respond?

Related:

Upvotes: 2

Views: 1326

Answers (1)

Opal
Opal

Reputation: 84854

The code you need is 403 Forbidden:

From wikipedia:

A 403 response generally indicates one of two conditions:

  • Authentication was provided, but the authenticated user is not permitted to perform the requested operation.
  • The operation is forbidden to all users. For example, requests for a directory listing return code 403 when directory listing has been disabled.

Upvotes: 3

Related Questions