What is the difference between HTTP 401 and 403?
HTTP 401 generally indicates that authentication is required or that the supplied authentication credentials are not acceptable. HTTP 403 indicates that the server understood the request but refuses to authorize it. A common distinction is: 401 means the caller is not successfully authenticated, while 403 means the authenticated caller does not have sufficient permission.
Key Takeaways
- 401 relates to authentication.
- 403 relates to authorization.
- Exact API behavior should remain consistent and documented.
Knowledge Check
Which status code commonly indicates that an authenticated user lacks permission?