Fiori 403 Root-Cause Doctor

Deterministic decision-tree diagnosis across HTTP 403 / unauthorized errors (CSRF, session / browser, ICF, Gateway, authorization, UCON, BTP destination, Cloud Connector) with a missing-data report

Content reviewed September 26, 2026

Engine: FIORI_403_ROOT_CAUSE_DOCTOR
Domain: Operations
Version: 2.2.0
Target releases: S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408
Accepted formats: JSON, CSV, TEXT

Input contract

403 diagnostic telemetry: JSON {'http_response': {status_code, method, url, headers, body}, 'su53': [...], 'iwfnd_error_log': [...], 'icf_services': [...], 'ucon_rules': [...], 'cloud_connector_logs': [...], 'btp_destination': {name, url, proxy_type, authentication, check_status}}, a browser network export (HAR JSON {'log': {'entries': [...]}}), an HTTP request/response text dump or SU53 text export, or SICF/SU53 CSV artifacts.

Required input

At least one telemetry source (HTTP trace or HAR, SU53, /IWFND/ERROR_LOG, SICF, UCON, BTP destination, Cloud Connector)

HAR exports are read up to 2000 entries; cookie, authorization and other credential header values are never copied into findings or metrics (only cookie names are compared).

Finding codes

Finding codes (9)

FIORI_ICF_INACTIVEDefault severity: BlockerCategory: ICF Configuration
ICF service node inactive (SICF)
Remediation: Activate the service node and its parents in SICF (or /IWFND/MAINT_SERVICE > ICF Node > Activate).
FIORI_AUTH_OBJECT_MISSINGDefault severity: CriticalCategory: Authorization / Security
Authorization check failed (SU53)
Remediation: Add the failing authorization object values (e.g. S_SERVICE for the service hash, S_START) to the user's PFCG role — via the Fiori business catalog / IAM app in the cloud — and regenerate the profile.
FIORI_BTP_DESTINATION_AUTH_FAILEDDefault severity: CriticalCategory: Infrastructure / BTP Destination
BTP destination rejected by or not authenticating to the backend
Remediation: In the BTP cockpit fix the destination's authentication (type, technical user / certificate, principal propagation trust with the Cloud Connector and CERTRULE mapping) until 'Check Connection' succeeds, then retry the app.
FIORI_CLOUD_CONNECTOR_DENIEDDefault severity: CriticalCategory: Infrastructure / Cloud Connector
Denied by SAP Cloud Connector
Remediation: Expose the backend resource path in the Cloud Connector access control and fix principal propagation (trust / CN mapping).
FIORI_CSRF_TOKEN_INVALIDDefault severity: CriticalCategory: Security / CSRF
CSRF token missing or invalid on modifying request
Remediation: Fetch a token with 'X-CSRF-Token: Fetch' on a GET/HEAD, then send the token and session cookies with the POST/PUT/PATCH/DELETE; check that proxies / Web Dispatcher keep the session cookie.
FIORI_GATEWAY_SERVICE_NOT_ACTIVATEDDefault severity: CriticalCategory: Gateway Service Registration
Gateway service not registered / no system alias
Remediation: Register and activate the OData service in /IWFND/MAINT_SERVICE (V2) or /IWFND/V4_ADMIN (V4) and assign the correct system alias.
FIORI_UCON_DENIEDDefault severity: CriticalCategory: Network / UCON
Blocked by UCON / RFC allowlist
Remediation: Add the service / RFC function to the UCON communication assembly (UCONCOCKPIT) allowlist or move it out of the logging phase correctly.
FIORI_SESSION_BROWSER_ISSUEDefault severity: MajorCategory: Session / Browser
Session expired or the browser did not send the session cookie
Remediation: Reload the launchpad to re-establish the logon session; if the SAP session / SSO cookie keeps being dropped, align the host names (Web Dispatcher / approuter / backend), allow the cookie in the browser (third-party cookie and SameSite=None; Secure settings) and check the session timeout.
FIORI_403_INSUFFICIENT_TELEMETRYDefault severity: MinorCategory: Diagnostic Telemetry Gap
Root cause not determinable from supplied telemetry
Remediation: Capture an SU53 trace, the /IWFND/ERROR_LOG entry and the SICF status for the failing request and re-run; the supplied data did not identify a root cause.

Input validation codes (5)

FIORI_403_ARCHIVE_REJECTEDDefault severity: MajorCategory: INPUT_VALIDATION
Archive rejected by ingestion safety limits
Remediation: The archive exceeded the 100:1 expansion ratio, 500 MB total size, entry-count or 2-level nesting limit, or contained path traversal / encrypted members. Upload a flat, unencrypted archive of the export files. No verdict was produced. Re-export the artifact in one of the formats accepted by Fiori 403 Root-Cause Doctor (JSON, CSV, TEXT) and re-run the analysis.
FIORI_403_INVALID_INPUTDefault severity: MajorCategory: INPUT_VALIDATION
Artifact does not match the engine input contract
Remediation: Provide the artifact type documented for this engine; unrelated or structurally invalid documents are rejected. No verdict was produced. Re-export the artifact in one of the formats accepted by Fiori 403 Root-Cause Doctor (JSON, CSV, TEXT) and re-run the analysis.
FIORI_403_PARSE_ERRORDefault severity: MajorCategory: INPUT_VALIDATION
Artifact could not be parsed
Remediation: Fix the syntax error at the reported line/column (or re-export the file unmodified from SAP). No verdict was produced. Re-export the artifact in one of the formats accepted by Fiori 403 Root-Cause Doctor (JSON, CSV, TEXT) and re-run the analysis.
FIORI_403_PAYLOAD_TOO_LARGEDefault severity: MajorCategory: INPUT_VALIDATION
Artifact exceeds the size limit
Remediation: Split the export (e.g. per package, company code or date range) so each upload stays under the service payload limit. No verdict was produced. Re-export the artifact in one of the formats accepted by Fiori 403 Root-Cause Doctor (JSON, CSV, TEXT) and re-run the analysis.
FIORI_403_INSUFFICIENT_INPUTDefault severity: InfoCategory: INPUT_VALIDATION
Required input missing
Remediation: Supply every input the engine's contract marks as required (see the engine catalog entry). No verdict was produced. Re-export the artifact in one of the formats accepted by Fiori 403 Root-Cause Doctor (JSON, CSV, TEXT) and re-run the analysis.

Back to the documentation