Trace a 403 forbidden API error

Question

I have a client using one of our products, and no matter what we do, they continue to receive a 403 Forbidden error when executing a Query API call.  I have ensured they have an assigned Role with Extensibility (full), and Analysis (export) permissions; they even have supervisor Database View permissions and still get a 403 error.  I see in the 403 error message that there is a "trace_id" and I hope that Blackbaud has a way to trace back the object/call that is causing the error based on the trace ID.

I have tried to recreate this in our RENXT sandbox, and as soon as I assign the permissions above the forbidden error goes away, but not so much for my client.

I'm open to all suggestions!

Ken Swift · Answer

I did check all the permissions, and then this morning, the client let me know that everything started working.  They aren't aware of any permission changes on their side.  Fingers crossed it continues working…

Thanks Alex!

Alex Wong · Answer

did you check the application-level permission to the environment you are running API against?

Ken Swift · Answer

Hi Alex - I can reproduce both in the Blackbaud Console and our application.  I know the auth is working because, just before the execute Query, we make successful calls to get the query field IDs to construct the query.   Also, using the test Query in the Sky API console, we get the same error when using the user's auth token.  Therefore, I know it is permissions related, but as I said, they have extensibility (full), Analysis (export) and are a Supervisor in database view.

Thanks for your response!