{"record":{"id":"0b69234dd9984454","repo":"we-promise/sure","slug":"access-forbidden-0b6923","errorCode":"access_forbidden","errorMessage":"Access forbidden - check your application permissions","messagePattern":"Access forbidden - check your application permissions","errorType":"exception","errorClass":"EnableBankingError","httpStatus":403,"severity":"error","filePath":"app/models/provider/enable_banking.rb","lineNumber":289,"sourceCode":"      {\n        \"Authorization\" => \"Bearer #{generate_jwt}\",\n        \"Accept\" => \"application/json\"\n      }\n    end\n\n    def handle_response(response)\n      case response.code\n      when 200, 201\n        parse_response_body(response)\n      when 204\n        {}\n      when 400\n        response_data = parse_error_response_body(response)\n        raise EnableBankingError.new(\"Bad request to Enable Banking API: #{response.body}\", :bad_request, response_data: response_data)\n      when 401\n        raise EnableBankingError.new(\"Invalid credentials or expired JWT\", :unauthorized)\n      when 403\n        raise EnableBankingError.new(\"Access forbidden - check your application permissions\", :access_forbidden)\n      when 404\n        raise EnableBankingError.new(\"Resource not found\", :not_found)\n      when 408\n        raise EnableBankingError.new(\"Request timeout from Enable Banking API\", :timeout)\n      when 422\n        response_data = parse_response_body(response)\n        raise EnableBankingError.new(\"Validation error from Enable Banking API: #{response.body}\", :validation_error, response_data: response_data)\n      when 429\n        raise EnableBankingError.new(\"Rate limit exceeded. Please try again later.\", :rate_limited)\n      else\n        response_data = parse_error_response_body(response)\n        raise EnableBankingError.new(\"Failed to fetch data: #{response.code} #{response.message} - #{response.body}\", :fetch_failed, response_data: response_data)\n      end\n    end\n\n    def parse_error_response_body(response)\n      return {} if response.body.blank?\n","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/app/models/provider/enable_banking.rb#L271-L307","documentation":"Raised by Provider::EnableBanking#handle_response on HTTP 403: the JWT authenticated fine but the application is not permitted to use the endpoint or resource. Enable Banking gates endpoints by application permissions (and production access by licensing/onboarding state), so this is a portal-side configuration issue, not a code bug.","triggerScenarios":"A sandbox-only application calling production endpoints (BASE_URL is hardcoded to api.enablebanking.com); the application's plan doesn't include an endpoint family; PSU-context requirements (e.g. some ASPSPs require PSU headers/IP) rejecting the request as forbidden.","commonSituations":"Moving from sandbox testing to production without completing Enable Banking onboarding, new endpoints enabled in the docs but not on the application, regional/licensing restrictions.","solutions":["Check the application's permissions and plan in the Enable Banking portal and request access for the endpoint family you're calling","Confirm the application has been activated for production if you're calling live endpoints","If the 403 is bank-specific, check whether that ASPSP requires PSU headers (pass psu_headers: on get_account_details/balances/transactions)","Contact Enable Banking support with the application_id when permissions look correct but the error persists"],"exampleFix":"# before\nclient.get_account_transactions(account_id: uid) # some ASPSPs require PSU context\n\n# after\nclient.get_account_transactions(\n  account_id: uid,\n  psu_headers: { \"PSU-IP-Address\" => user.last_ip, \"PSU-User-Agent\" => request.user_agent }\n)","handlingStrategy":"validation","validationCode":null,"typeGuard":"def eb_forbidden?(error)\n  error.is_a?(Provider::EnableBanking::EnableBankingError) && error.error_type == :access_forbidden\nend","tryCatchPattern":"begin\n  client.get_account_transactions(account_id: uid)\nrescue Provider::EnableBanking::EnableBankingError => e\n  raise unless e.error_type == :access_forbidden\n  Rails.logger.warn(\"EB 403 for #{uid}: application permissions or PSU headers required\")\n  next # skip and surface to ops; retrying will not change the grant\nend","preventionTips":["Complete production onboarding/licensing before pointing at live endpoints","Pass psu_headers (PSU-IP-Address, PSU-User-Agent) for ASPSPs that require PSU context — safe_psu_headers strips only dangerous keys","Track per-bank 403 rates to spot banks needing extra headers or permissions","Escalate to Enable Banking support with application_id when permissions look correct"],"tags":["enable-banking","http-403","authorization","licensing"],"backgroundTag":"http-403-forbidden","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}