HTTP 403 in broker APIs: what it means, broker by broker
22 decoded error codes from 7 brokers and platforms return this status, and one general record gives the standard's meaning: 23 records on this page. The count is of records whose recorded HTTP status is 403. A search for the number 403 also finds records that only mention it in their code or meaning, so the error lookup can show more.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
What the status means in general
HTTP 403 is Forbidden. The server understood the request and refuses to fulfil it. If credentials were sent, the server considers them insufficient, and the standard says a client should not automatically repeat the request with the same credentials.
With a trading API, 403 usually means the key or account is known but not allowed to do this: a permission not granted, a product the account cannot use, an address that is not on an allow list. Some APIs also use 403 for an exceeded allowance, so read the body.
Read the API's own code in the body. Check the permissions on the key and the account type. Logging in again with the same credentials will not help.
The first paragraph is the standard's meaning in this site's words, with its source. The rest is this site's own explanation and describes no particular broker. HTTP 403 Forbidden on its own page.
The status alone is only the category. The code or message in the body of the reply is what tells you the cause, and that differs from one API to the next.
The decoded errors that return it
In order of broker name, then code. Each row links to the full meaning and the fix.
DXtrade APIs
| Code | Meaning, first sentence | Source |
|---|---|---|
| 99 Conditional request required | DXtrade errorCode 99, description "Conditional request required" (the vendor's wording). | demo.dx.tradechecked |
| 403 Forbidden | DXtrade REST API: The client submitted a request without the required condition. | demo.dx.tradechecked |
eToro
| Code | Meaning, first sentence | Source |
|---|---|---|
| HTTP 403 | The key or token is recognised but lacks the permission this call needs. | api-portal.etoro.comchecked |
IG
| Code | Meaning, first sentence | Source |
|---|---|---|
| endpoint.unavailable.for.api-key | The API key was not accepted for this endpoint. | labs.ig.comchecked |
| error.public-api.exceeded-account-allowance | The account's traffic allowance has been exceeded. | labs.ig.comchecked |
| error.public-api.exceeded-account-historical-data-allowance | The account's allowance for historical data has been exceeded. | labs.ig.comchecked |
| error.public-api.exceeded-account-trading-allowance | The account's allowance for trading requests has been exceeded. | labs.ig.comchecked |
| error.public-api.exceeded-api-key-allowance | The traffic allowance of the API key has been exceeded. | labs.ig.comchecked |
| error.public-api.failure.product-code-not-allowed | The account's product type is not supported for public API users. | labs.ig.comchecked |
| error.public-api.failure.stockbroking-not-supported | IG's reference describes this code as "Stockbroking not supported for Public API users." It is listed under HTTP 403 in the Exceptions tables for /session. | labs.ig.comchecked |
| error.security.api-key-disabled | The API key was not accepted because it is not currently enabled. | labs.ig.comchecked |
| error.security.api-key-invalid | The API key provided was not accepted. | labs.ig.comchecked |
| error.security.api-key-restricted | The API key is not valid for the account making the request. | labs.ig.comchecked |
| error.security.api-key-revoked | The API key was not accepted because it has been revoked. | labs.ig.comchecked |
| unauthorised.access.to.equity.exception | The account is not authorised to access equity data. | labs.ig.comchecked |
| unauthorised.api-key.revoked | The API key is in the revoked state and cannot be used. | labs.ig.comchecked |
| unauthorised.clientId.api-key.mismatch | The API key does not belong to the authenticated individual. | labs.ig.comchecked |
OANDA
| Code | Meaning, first sentence | Source |
|---|---|---|
| Account not tradable | The token is valid but the account cannot trade. | developer.oanda.comchecked |
Saxo OpenAPI
| Code | Meaning, first sentence | Source |
|---|---|---|
| HTTP 403 | Forbidden. | developer.saxochecked |
TradeLocker API
| Code | Meaning, first sentence | Source |
|---|---|---|
| 403 Forbidden | TradeLocker lists 403 with the description "Forbidden" as a response of its /trade routes, including placing, modifying and cancelling orders. | public-api.tradelocker.comchecked |
Trading 212
| Code | Meaning, first sentence | Source |
|---|---|---|
| HTTP 403 | The request was refused. | Unverifieddocs.trading212.comchecked |
| Missing Permissions | The API key lacks the permission the endpoint needs. | docs.trading212.comchecked |
Brokers and platforms not listed here have no decoded error recorded with this status. That describes this dataset, not their APIs.