403 is a permissions based response, it is most often associated with the permission level of the API Key being used. We generally recommend that your API Key is generated by a user profile with the appropriate level of access necessary to accomplish your goals within Kisi.
This will typically need to be an Owner or Organization Admin profile. Although there are some use-cases in which you might want to use a lower privillage level. Especially if you are creating a third-party application that will use the Kisi API to grant access to doors for users at specific access levels.
Use Fetch User with the API key to identify what user it belongs to. Check that this user has the appropriate permissions in the kisi web dashboard or share results with Support to look into it.
Example of Fetch User API Response:
There are some additional conditions that can lead to a 403 error when calling the Kisi API that are not specifically tied to your users access level. Many of the API calls used in Kisi will have you making use of database IDs in the form of integer values. When you receive a 403 error as a response and you have double checked the permission level for your API Key this will generally be the cause.
As an example let's say that you are trying to add a user to a group in your Organization and the ID for the group is group_id 101, but you've mistyped it as group_id 10.
Example of invalid ID in request causing 403 error:
As you can see, this will also return a 403 response from the API. This can happen even if you have entered an ID that does not exist, such as a "0". So be sure to double check any IDs that you are using by either running a fetch call to the appropriate endpoint, or checking the URL for the relevant target in the Kisi Dashboard.
Example URL:
https://web.kisi.io/organization/organization_id/groups/group_id
You can find a comprehensive list of our Supported API Requests here