A 403 Forbidden response means that Auvik received the request, but the credentials are not authorized to access the requested endpoint, tenant, or resource.
Confirm the authentication method
Make sure the credentials match the API family and endpoint being used.
Unified Auvik API
Unified API endpoints use HTTP Basic Authentication with:
- The Auvik user’s email address as the username.
- The user’s Auvik API key as the password.
Auvik SaaS Management API
ASM Integration endpoints use the Integration Key and Secret generated for the ASM integration.
Do not use ASM Integration credentials with Unified API endpoints or Unified API credentials with ASM Integration endpoints.
Confirm the region and base URL
Verify that the request uses the regional API base URL for the tenant.
A request sent to the wrong regional endpoint may fail even when the credentials are valid.
Also confirm that:
- The endpoint belongs to the API family you intend to use.
- The tenant or site identifier is correct.
- Outbound HTTPS access to the API endpoint is allowed.
Check permissions and tenant access
For Unified API requests, confirm that the Auvik user or service account:
- Has API access enabled.
- Has the specific API permission required by the endpoint.
- Has access to the requested site, client, or tenant.
- Has access to every tenant included in a multi-tenant request.
For ASM Integration requests, confirm that the Integration Key and Secret are active and configured for the required ASM data.
If the user’s role or site access was recently changed, the API key will use the updated permissions. Ask an Auvik administrator to verify the account’s role and tenant access.
Common causes of a new 403 error
A request that previously worked may begin returning 403 when:
- The user’s role or site access was changed.
- The user account was disabled or removed.
- The API key was regenerated or revoked.
- The integration is still using an old key.
- The request is using credentials from the wrong API family.
- The API account is not authorized for one or more tenants in an aggregate request.
- The endpoint requires a permission that the account does not have.
- The subscription does not include the API family or resource being requested.
Troubleshooting steps
- Identify the endpoint and confirm whether it belongs to the Unified API or ASM API.
- Verify that the credential type matches that API family.
- Confirm that the regional base URL and tenant or site scope are correct.
- Ask an Auvik administrator to verify the API account’s role, API permissions, and tenant access.
- Test a simple read-only request that the account should be authorized to use.
- If the key may be stale, generate or rotate the credential and update the integration immediately.
- Retest the original request after confirming the replacement credential is active.
Do not repeatedly retry a request before checking the endpoint, credentials, and permissions.
If the request still returns 403
Contact Auvik Support and provide:
- The API family and endpoint.
- The HTTP method.
- The tenant, client, or site being requested.
- The HTTP status and response body.
- The date and time of the request, including timezone.
- The API account type and assigned scope, without including credentials.
Do not include API keys, secrets, passwords, authorization headers, or other sensitive credentials in a support request.