403 error when creating request via API | The place for Zendesk users to come together and share
Skip to main content
January 27, 2021
Question

403 error when creating request via API

  • January 27, 2021
  • 23 replies
  • 148 views

Hi,

I'm creating a custom form for our end-users within Zendesk itself. When I try to call the https://subdomain.zendesk.com/api/v2/requests API to create the request, it returns with a 403 error. I'm using an api token for auth. The API call works in postman and I was able to create a request but when I try to call it in my custom form in zendesk, it gives me a 403 error.


We are on Proffesional.

{
"error": {
"title": "Forbidden",
"message": "Invalid authenticity token"
}
}

 

Not sure what I'm doing wrong since the call works on postman.

var myHeaders = new Headers();
myHeaders.append("Authorization", "Basic btoa(email/token:API_TOKEN)");
myHeaders.append("Content-Type", "application/json");
myHeaders.append("Cookie", "__cfduid=d3d63f8118c012940ee1e08701ec6140d1610414533; _zendesk_session=BAh7CEkiD3Nlc3Npb25faWQGOgZFVEkiJTBiMGNlNTVlOGVhNjQ4NTcyMDkxNGJjMzZjOWQxNTdhBjsAVEkiDGFjY291bnQGOwBGaQMvZ5JJIgpyb3V0ZQY7AEZpA7nELw%3D%3D--2608b56780c88cadb0776d6913aace910de8a12b; __cfruid=da3497d68006538ec0acea547c226758ea2a06fc-1611699971");

var raw = JSON.stringify({"request":{"subject":"TESTING API!","comment":{"body":"My printer is on fire!"}}});

var requestOptions = {
  method: 'POST',
  headers: myHeaders,
  body: raw,
  redirect: 'follow'

};

fetch("https://subdomain.zendesk.com/api/v2/requests", requestOptions)
  .then(response => response.text())
  .then(result => console.log(result))
  .catch(error => console.log('error', error));

23 replies

Pan12
January 13, 2022

Can anyone help me? I am not sure what to do now.

Andrey24
January 13, 2022

@tipene @pan12 I'm getting the same "Invalid authenticity token" error.

I sent a request to Zendesk support 2 days ago, but haven't received a reply yet.

Pan12
January 16, 2022

@andrey24

Hi  have you received response from Zendesk support? Can you share it to me? Thanks.

Andrey24
January 20, 2022

@pan12 still troubleshooting it with Zendesk support. I'll write you once the issue is resolved.

Elton
May 26, 2022

I am having this error 403 when I am trying to log in into my account as AGENT. I go until the second step verification and then it goes to the error 403. How Can I correct it and log in??

Joshua43
Employee
May 31, 2022
Hi Elton!
 
Thank you for reaching out to us. This can be corrected by logging in the correct credentials however, I would highly advise that you get it touch with your admins as they have control over this in your account.
 
Best,
Manuel34
June 10, 2022

@pan12 Your issue seems to be related to the organizations api end point. According to the documentation you need to be an admin to create organizations. If an end user tries this, then they shoudn't have the required permissions to do so.

 

@tipene Your approach looks nice. I didn't know about the x-csrf-token header. I think the authenticity_token property should be included in the JSON format of the user documentation.

I tried it but it sadly didn't work for me. I checked in the developer console > network what the request looks like. The basic authentication and x-csrf-token match with the data I'm plugging in but I still get a 403 error.

I'm sending the request through a ReactJS app and Axios in our Help Center.

August 15, 2022

This error indicates that the server has determined that you are not allowed access to the thing you've requested, either on purpose or due to a misconfiguration . It's probably because the site owner has limited access to it and you don't have permission to view it. The vast majority of the time, there's not much you can do to fix things on your (*client) end. There are four common causes for 403 Forbidden error (server side) . Here they are listed from most likely to least likely:

  • An empty website directory
  • No index page
  • Incorrect settings in the .htaccess file
  • Permission / Ownership error

If authentication credentials were provided in the request, the server considers them insufficient to grant access. The client SHOULD NOT automatically repeat the request with the same credentials. The client MAY repeat the request with new or different credentials. However, a request might be forbidden for reasons unrelated to the credentials.

 

Greg K
Employee
September 23, 2022

Hi Ahmed! A 403 is an indication that you don't have access to the resource. Do you have different permissions in the other instance?

Greg K
Employee
October 3, 2022

Have you enabled agent access to create requests in this new instance? If not, here are the instructions on how to do so. Let me know if that works for you!