4xx Client Error
403Forbidden
The client is authenticated (or authentication would not help) but is not permitted to access the resource. The server may omit the reason to avoid disclosure.
Security relevance
Inconsistent 403 vs 404 responses can enable resource enumeration; forced browsing that returns 200 instead of 403 indicates broken access control.