[SOLVED] 403 when accessing GraphQL API

I have…

  • [ ] Checked the logs and have uploaded a log file and provided a link because I found something suspicious there. Please do not post the log file in the topic because very often something important is missing.

I’m submitting a…

  • [x] Regression (a behavior that stopped working in a new release)
  • [ ] Bug report
  • [ ] Performance issue
  • [ ] Documentation issue or request

Current behavior

GraphQL requests return 403.

Expected behavior

No 403 :slight_smile:

Minimal reproduction of the problem

Our graphQL requests return 403 errors like the following for most requests on various clients):

  "type": "https://tools.ietf.org/html/rfc7231#section-6.5.3",
  "title": "Forbidden",
  "status": 403,
  "traceId": "00-cb39f46fe654ed42b58b9644fd898575-74ec8866c70a2146-00"

It doesn’t matter whether we access the API via the CDN or directly.


  • [ ] Self hosted with docker
  • [ ] Self hosted with IIS
  • [ ] Self hosted with other version
  • [x] Cloud version

Version: latest cloud


  • [ ] Chrome (desktop)
  • [ ] Chrome (Android)
  • [ ] Chrome (iOS)
  • [ ] Firefox
  • [ ] Safari (desktop)
  • [ ] Safari (iOS)
  • [ ] IE
  • [ ] Edge

It affects our development and production clients and broke from one minute to the next - I cannot say when exactly but my guess is it started maybe 1 hour ago (that’s at least when I saw it first on a dev version and started to check my in-development code for errors before finding out, that it also affects the live version).

What permission do you use?

We are using the Reader permission on all clients.

I will provide a fix asap.

1 Like

Lovely! Can you afterwards (whenever you have time, no need to hurry) let us know what broke? I’m interested in that kind of things. :slight_smile:

I have rolled back the last deployment. It should hopefully work again.

1 Like

It looks like it works again, many thanks! :pray:

I have deployed the final fix.

@Sebastian unfortunately we are starting to see 403s again. :frowning:

Fuck, do you use the GET or POST endpoint?

Sorry for the late reply - we are using GET.

I think it has been fixed, can you approve that?

1 Like

Works like a charm, many thanks!

1 Like

Sorry for the inconveniences. Rough days.

No worries, happens to the best. :sweat_smile:

1 Like

This topic was automatically closed after 2 days. New replies are no longer allowed.