Errors

forbidden

Last updated: October 2026

Use a credential authorized for the route. The credential is valid but does not grant access to the requested route group.

What happened

Unlike unauthorized, changing the header syntax or request body cannot add permission. The credential must be replaced or its access changed outside this request. On GET /v2/window-sticker/{sha} the credential is the signed link itself: forbidden means the link has expired or was altered.

Do this next

Use a key or session that is authorized for the route, or ask the Cardog account owner to grant access. Do not retry unchanged with the same credential. For a window sticker link, request GET /v2/vin/{vin}/window-sticker again and open the new downloadUrl.

Corrected request


curl "https://api.cardog.app/v2/vin/2T3R1RFV7MW180266" \
  -H "x-api-key: $AUTHORIZED_CARDOG_API_KEY"

Was this helpful?