Werk #18241: REST API: permission denials now return 403 instead of 401 on some endpoints
| Component | REST API | ||
| Title | REST API: permission denials now return 403 instead of 401 on some endpoints | ||
| Date | Aug 13, 2026 | ||
| Level | Trivial Change | ||
| Class | Bug Fix | ||
| Compatibility | Incompatible - Manual interaction might be required | ||
| Checkmk versions & editions |
|
Previously, some REST API endpoints that denied a request because the authenticated user lacked a required permission returned an HTTP 401 Unauthorized instead of 403 Forbidden. This made it impossible for an API client to distinguish "your credentials are invalid" from "you're authenticated, but not allowed to do this" — a client reacting to 401 by re-authenticating would just hit the same 401 again, forever.
This has been fixed for the affected endpoints: they now return 403 Forbidden with a permission-specific detail message when an authenticated user lacks the required permission, matching the behavior already used elsewhere in the REST API.
Compatibility note
If your API client or automation checks for a 401 status code to detect a permission problem, update it to check for 403 instead. 401 is now reserved for actual authentication failures (invalid or expired credentials, locked accounts, etc.) on more endpoints than before.