How to troubleshoot 403 Forbidden errors

This topic provides guidance on how to troubleshoot 403 Forbidden errors when accessing HERE services. Access denial errors appear when HERE IAM denies access to a resource or service.

There are various reasons why access can be denied, and HERE IAM provides detailed error messages to help you understand why access was denied and how to resolve the issue.

Error message format

The following is an example of an error message response:

{
  "title": "Forbidden",
  "status": 403,
  "code": "403403",
  "cause": "User HERE-00000000-000-0000-0000-00000000 credentials do not authorize access to perform invoke action on hrn:here:service::olp-here:routing through SERVICE-00000-0000-000-0000 service because no matching permissions found for the identity, its groups and roles, or the realm.",
  "action": "Add/Share the necessary permissions to the identity."
}

📘
Note
The cause field in the error message provides a detailed explanation of why access was denied.

User/App {identity} credentials do not authorize access to perform {action} action on {resource} through {service} service because {reason}.

HRN parameter	Definition
identity	One of User or App ID used to make the request
action	Action requested to be performed on the resource
resource	The HRN of the resource that the request is made for
service	The service requested to access
reason	Reason for the access denial

📘
Note
The action field in the error message provides you with a hint on how to resolve the denial issue.

Common reasons for access denial

Deny reason	Action	Description
No matching permissions found for the identity, its groups and roles, or the realm.	Add/Share the necessary permissions to the identity.	The error refers to missing permissions on the calling identity. Either verify your account subscription to see if you have access to the resource, or request the resource owner to add or share the permissions necessary for access.
Resource relation is missing.	Link the resource to the project.	The error refers to no resource link being found. Add a link with the required actions for the resource in the project.
Resource relation is inactive.	Resource link has expired. Extend the resource plan attachment.	The error refers to the expiry of the access to the resource. Verify that your subscription to the resource is still valid and resubscribe if it has expired.
Resource home is missing.	Add/Create the resource in the project.	The error refers to no home found for the resource. Verify that the resource exists in a project.
Resource home cannot be referenced.	Check the resource reference configuration.	The error refers to incorrect resource configuration. Verify your account subscription or reach out to access support for assistance.
Referenced resource is not authorized.	Check the identity and resource reference configuration.	The error refers to missing permissions on the calling identity. Verify your account subscription or reach out to access support for assistance.
Resource plan attachment has expired.	Extend the resource plan attachment.	The error refers to the expiry of the subscription. Verify that your subscription to the resource is still valid, and resubscribe if it has expired.
Resource plan attachment is missing.	Attach the missing resource plan.	The error refers to a missing subscription. Verify that you have a subscription to the resource you are trying to access.
Linkable resource is missing.	Check the resource link availability configuration.	The error refers to missing linkable resource. Verify that the resource you are trying to link is available as a linkable resource.
Resource is linked with subresources only.	Check the resource link configuration.	The error refers to missing subresources in the request. Verify that the access request made is for the subresources to which the resource is linked.
Cross realm trust is missing.	Establish a cross realm trust relationship to access the resource.	The error refers to a missing cross realm trust relationship. To access a resource cross realm, verify that there is a cross realm trust relationship created between the two organizations.
Action is not permitted.	Retry with the allowed actions for access.	The error refers to an action not being permitted for the service. Verify that the action requested is allowed through the resource link in the project.
Action is not permitted by project policy.	Correct the action used or update the project policy configuration.	The error refers to an action not being permitted by project policy. Verify that the project policies are assigned to the calling identity. A project policy is restricting access for the action requested.
Subresource binding is inactive.	Extend the resource plan attachment containing the subresource binding.	The error refers to the expiry of the subresource binding. Verify that your subscription to the resource is still valid and resubscribe if it has expired.
No resource plan associated.	Reattach the resource plan containing the resource.	The error refers to a missing subscription. Verify that you have a subscription to the resource you are trying to access.
An access filter restricting access is attached on the identity's roles or the Org (realm).	Check the attached access filter statements that restrict access.	The error refers to access being restricted due to an access filter attached to the identity. Verify the roles assigned to the identity and also any organization access filter settings.