forbidden

HTTP 403   title: Forbidden

What it means

The caller is authenticated, but this identity may not do this. The generic 403 of the vocabulary — four codes share the status, and the three below name a specific, recoverable reason.

What to do next

Not recoverable by retrying the same call with the same identity. If the action needs a KYC attribute you will get kyc_required instead; if it needs a higher spending cap, spending_cap_exceeded. A plain forbidden means the operator’s own authorization said no.

On the wire

{
  "type":   "https://kiosk.tech/problems/forbidden",
  "title":  "Forbidden",
  "status": 403,
  "detail": "… what went wrong on THIS request …",
  "code":   "forbidden"
}

This page documents the RFC 9457 type URI https://kiosk.tech/problems/forbidden. The URI is an identifier, not a locator a client should fetch: branch on the document’s code member. The normative definition lives in the error vocabulary of the Kiosk specification (§9 of the formal spec).