Problem type:
https://docs.nordicfinancialnews.com/problems/auth-insufficient403 when your API key is recognized and active, but is not permitted to make the request you made. Two things produce it:
- The key lacks the scope the endpoint requires. Most endpoints require
read. Watchlist endpoints, and watchlist filters on other endpoints, requireread:watchlist. - The key has an IP allowlist and your request did not come from an address on it. An allowlist is optional. If you have not set one, this cause does not apply to you.
Example response
detail is a fixed string. It does not name the missing scope and it does not distinguish a scope failure from an allowlist failure, so check both.
How to fix it
Open API key settings and check the key’s scopes against what the endpoint needs, then check its IP allowlist against where your code actually runs. A deployment that moved hosts, or one that egresses through a new address, produces this error with no change to your code at all. Scopes are fixed at the key’s current value for every request it makes, so widening them means editing the key rather than asking for more at call time. See API key scopes and permissions. Retrying does not help, with one exception: if the cause was an allowlist and your egress address varies, the same request can succeed from a different address. That is worth fixing at the allowlist rather than relying on.Not the same as the other 403
Plan limit exceeded also returns403. The two say different things and have different remedies:
Branch on
type rather than on the status code, or you will send someone to the upgrade page over a missing scope.
Related
- Authentication for the full scope list and how keys are configured
- Error handling for the full problem type list
- Authentication required for the
401returned when the key itself is missing or invalid