HTTP status code
HTTP status code: 403 Forbidden
What does 403 Forbidden mean in HTTP?
The server understood the request and refuses to fulfil it. If credentials were sent, the server considers them insufficient, and the standard says a client should not automatically repeat the request with the same credentials.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
What it means in trading API work
With a trading API, 403 usually means the key or account is known but not allowed to do this: a permission not granted, a product the account cannot use, an address that is not on an allow list. Some APIs also use 403 for an exceeded allowance, so read the body.
This part is this site's own explanation, written for people learning to call a trading API. It is not part of the source cited above and it describes no particular broker.
What should I do about 403 Forbidden?
Read the API's own code in the body. Check the permissions on the key and the account type. Logging in again with the same credentials will not help.
This page is an independent explanation in plain words. The definition itself is in the source it was read from, which is the authority if the two ever differ.