Which HTTP status code indicates access is forbidden due to insufficient permissions?

Which HTTP status code indicates access is forbidden due to insufficient permissions?

• A. Unauthorized - Authentication is required
• B. Forbidden - The website can be reached, but more permissions are needed before accessing further
• C. Not Found - The resource does not exist
• D. Conflict - The request could not be completed due to a conflict

Answer: (B)

HTTP status codes that deal with access control tell you why a request didn’t succeed in terms of permissions. When a resource is reachable but your user account doesn’t have the rights to view it, the server responds with a forbidden status. This means the request was understood and you might be authenticated, but you’re not allowed to access that resource due to insufficient permissions. It’s different from an authentication failure, where you’re missing or have invalid credentials, and it’s different from not found (the resource doesn’t exist) or a conflict (the request would create an inconsistent state). So the option that describes access as forbidden because more permissions are needed is the correct one. If you need to act, you’d typically request the appropriate role or permissions, or contact an administrator to grant access.

HTTP status codes that deal with access control tell you why a request didn’t succeed in terms of permissions. When a resource is reachable but your user account doesn’t have the rights to view it, the server responds with a forbidden status. This means the request was understood and you might be authenticated, but you’re not allowed to access that resource due to insufficient permissions. It’s different from an authentication failure, where you’re missing or have invalid credentials, and it’s different from not found (the resource doesn’t exist) or a conflict (the request would create an inconsistent state). So the option that describes access as forbidden because more permissions are needed is the correct one. If you need to act, you’d typically request the appropriate role or permissions, or contact an administrator to grant access.