# 403 and 404

> Why a method responds with "access denied" or "not found" and how to tell an access problem from a typo in the route.

## How to tell them apart

```plaintext
403 → token accepted, route forbidden           → section "403"
404 → route not found or wrong HTTP method      → section "404"
401 → token expired or key disabled             → /en/concepts/auth/
```

## 403

The response body looks like this:

```json
{ "code": 403, "message": "forbidden", "error": "access denied", "data": null }
```

The cause depends on the `error` field:

| `error` in the body  | What it means                                    | What to do              |
| -------------------- | ------------------------------------------------ | ----------------------- |
| `access denied`      | the route is not in the list allowed for the key | see below               |
| `company is blocked` | the company is blocked                           | contact a BILLZ manager |

### If the message is `access denied`

Order of investigation:

**Step 1. The route exists.** Check the path and the verb against the [API reference](/en/reference/api/).

**Step 2. The route is in the key’s list** — [what an integration key can do](/en/reference/permissions/).

**Step 3. The route is not in the list** — request access separately, specifying the route, the HTTP method and the purpose.

**Step 4. The route is in the list, but `403` persists.** Check that the company is not blocked, the key is activated, and the request is sent with the same key.

**Step 5. The response is `200`, but the data is incomplete** — key role permissions: [what the access switches change](/en/reference/role-permissions/).

## 404

| Cause                     | What it looks like                                   | What to do                           |
| ------------------------- | ---------------------------------------------------- | ------------------------------------ |
| Wrong HTTP method         | the path is correct, the verb is not                 | check the verb against the reference |
| Typo in the path          | an extra `/api`, a concatenated URL, a missing slash | check the path                       |
| The method does not exist | the path was taken from old documentation            | find the current equivalent          |

## Further reading

* [What an integration key can do](/en/reference/permissions/) — the full list of available routes
* [Key role permissions](/en/reference/role-permissions/) — what the access switches change inside the allowed methods
* [Authentication and permissions](/en/concepts/auth/) — how the access model works