Werk #22710: REST API: permission denials now return 403 on the remaining endpoints
| Component | REST API | ||||
| Title | REST API: permission denials now return 403 on the remaining endpoints | ||||
| Date | Oct 22, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Bug Fix | ||||
| Compatibility | Incompatible - Manual interaction might be required | ||||
| Checkmk versions & editions |
|
Werk #18241 made REST API endpoints answer 403 Forbidden instead of 401 Unauthorized when the authenticated user lacks a required permission. Some endpoints were not covered by that change and kept answering 401, for example the endpoints for passwords, user roles and site connections. A client that reacts to 401 by re-authenticating would retry these requests without ever succeeding.
These endpoints now answer 403 as well, with the reason in the detail message. A 401 now always means that the credentials are missing or invalid, as the API documentation has stated since Werk #22431.
Compatibility note
If your API client or automation checks for a 401 status code to detect a missing permission, check for 403 instead.