403 and 404

How to tell them apart

403 → token accepted, route forbidden           → section "403"
404 → route not found or wrong HTTP method      → section "404"
401 → token expired or key disabled             → /en/concepts/auth/

403

The response body looks like this:

{ "code": 403, "message": "forbidden", "error": "access denied", "data": null }

The cause depends on the error field:

error in the body	What it means	What to do
access denied	the route is not in the list allowed for the key	see below
company is blocked	the company is blocked	contact a BILLZ manager

If the message is access denied

Order of investigation:

Step 1. The route exists. Check the path and the verb against the API reference.

Step 2. The route is in the key’s list — what an integration key can do.

Step 3. The route is not in the list — request access separately, specifying the route, the HTTP method and the purpose.

Step 4. The route is in the list, but 403 persists. Check that the company is not blocked, the key is activated, and the request is sent with the same key.

Step 5. The response is 200, but the data is incomplete — key role permissions: what the access switches change.

404

Cause	What it looks like	What to do
Wrong HTTP method	the path is correct, the verb is not	check the verb against the reference
Typo in the path	an extra /api, a concatenated URL, a missing slash	check the path
The method does not exist	the path was taken from old documentation	find the current equivalent

Further reading

• What an integration key can do — the full list of available routes
• Key role permissions — what the access switches change inside the allowed methods
• Authentication and permissions — how the access model works