Operations
SAP Fiori 403 Forbidden: root causes and fixes
Fiori 403 Root-Cause Doctor walks a deterministic decision tree over the HTTP response, SU53, the Gateway error log and SICF, UCON or Cloud Connector data and names the layer that refused the request.
Detected by:Fiori 403 Root-Cause Doctor
Documented problems
- BlockerICF service node inactive (SICF)
FIORI_ICF_INACTIVE
- CriticalAuthorization check failed (SU53)
FIORI_AUTH_OBJECT_MISSING
- CriticalBTP destination rejected by or not authenticating to the backend
FIORI_BTP_DESTINATION_AUTH_FAILED
- CriticalDenied by SAP Cloud Connector
FIORI_CLOUD_CONNECTOR_DENIED
- CriticalCSRF token missing or invalid on modifying request
FIORI_CSRF_TOKEN_INVALID
- CriticalGateway service not registered / no system alias
FIORI_GATEWAY_SERVICE_NOT_ACTIVATED
- CriticalBlocked by UCON / RFC allowlist
FIORI_UCON_DENIED
- MajorSession expired or the browser did not send the session cookie
FIORI_SESSION_BROWSER_ISSUE
- MinorRoot cause not determinable from supplied telemetry
FIORI_403_INSUFFICIENT_TELEMETRY
Terms used in this area
Background articles
- Troubleshooting HTTP 403 Forbidden in SAP Fiori appsThe usual causes of a 403 error when a Fiori app loads or calls its OData service — missing service authorizations, incomplete roles, inactive ICF services — and a systematic way to find the one that applies.
ERP Preflight is independent and not affiliated with SAP SE. SAP, ABAP, Fiori and S/4HANA are trademarks of SAP SE.