Fiori 403 error
HTTP 403 Forbidden in SAP Fiori
Also known as: not authorized, 403 Forbidden
The request reached SAP and the user is signed in, but access was refused: by an authorization check, an inactive ICF node, CSRF, Gateway or UCON.
In Fiori scenarios several layers can refuse a request, so the same error has different root causes: a missing authorization for the OData service (S_SERVICE) or the start authorization (S_START), incomplete role content, an inactive ICF node (SICF), a failed business authorization check, a missing CSRF token on a modifying request, an unregistered Gateway service, a UCON allowlist or the SAP Cloud Connector.
A systematic approach reproduces the error, notes the service from the network trace, checks the Gateway error log and SU53 for the time of the request, compares the user’s roles with what the app needs and verifies the ICF service in every system. Fix the role design, not the individual user, so the fix is transportable.
In ERP Preflight
The free Fiori 403 decision tree narrows the cause category; Fiori 403 Root-Cause Doctor determines the refusing layer from HTTP trace, SU53, /IWFND/ERROR_LOG, SICF, UCON and Cloud Connector data.
Problems that involve Fiori 403 error
- BlockerICF service node inactive (SICF)
- CriticalAuthorization check failed (SU53)
- CriticalCSRF token missing or invalid on modifying request
- CriticalBlocked by UCON / RFC allowlist
- MinorRoot cause not determinable from supplied telemetry
- CriticalBTP destination rejected by or not authenticating to the backend
- CriticalDenied by SAP Cloud Connector
- CriticalGateway service not registered / no system alias
Related terms
Free tools
- Fiori 403 decision tree
Guided questions to the likely cause category of a Fiori “not authorized” error — and what evidence to collect.
Background articles
- Troubleshooting HTTP 403 Forbidden in SAP Fiori appsThe usual causes of a 403 error when a Fiori app loads or calls its OData service — missing service authorizations, incomplete roles, inactive ICF services — and a systematic way to find the one that applies.
Written for ERP Preflight · reviewed September 27, 2026
All glossary termsERP Preflight is independent and not affiliated with SAP SE. SAP, ABAP, Fiori and S/4HANA are trademarks of SAP SE.