Which HTTP status code indicates that a request was valid but the user is not authorized to access the resource?

Which HTTP status code indicates that a request was valid but the user is not authorized to access the resource?

• A. 401 Unauthorized
• B. 404 Not Found
• C. 409 Conflict
• D. 403 Forbidden

Answer: (D)

When a request is well-formed but you aren’t allowed to access the resource, the server signals this with a Forbidden status. It means the server recognizes who you are (or attempted to authenticate) but your current permissions don’t grant access to that resource. This is different from needing authentication: if you need to provide credentials or re-authenticate, you’d see Unauthorized. The other statuses indicate different situations: Not Found means the resource isn’t there, and Conflict means your request can’t be completed because it clashes with the resource’s current state.

When a request is well-formed but you aren’t allowed to access the resource, the server signals this with a Forbidden status. It means the server recognizes who you are (or attempted to authenticate) but your current permissions don’t grant access to that resource. This is different from needing authentication: if you need to provide credentials or re-authenticate, you’d see Unauthorized. The other statuses indicate different situations: Not Found means the resource isn’t there, and Conflict means your request can’t be completed because it clashes with the resource’s current state.