Akamai Fast Purge 403 "The client does not have authorization" in CI

By Kaveh Alemi·Latchkey

Akamai authenticated the request but denied it: a 403 from the Fast Purge (CCU v3) API means the API client is not authorized for the CCU API, or lacks access to the objects/network being purged.

What this error means

A POST to /ccu/v3/invalidate/url (or /delete) returns HTTP 403 with a problem+json body whose title indicates the client is not authorized for the API.

{
  "type": "https://problems.luna.akamaiapis.net/-/pep-authz/deny",
  "title": "The client does not have authorization to access this resource.",
  "status": 403
}

Common causes

The API client has no CCU (Fast Purge) grant

The credentials in .edgerc belong to an API client that was not given access to the Fast Purge API, so authorization is denied.

The client cannot access the target property or network

The client authenticates but is not scoped to the property or the staging/production network you are purging.

How to fix it

Grant the client Fast Purge (CCU) access

1. In Identity and Access Management, add the CCU API with read-write to the API client.
2. Confirm the client is scoped to the property group you purge.
3. Regenerate and store the credentials, then re-run the purge.

# purge by URL on production via CCU v3 (uses .edgerc credentials)
akamai purge --edgerc ./.edgerc invalidate https://www.example.com/app.js

Confirm the network scope

Ensure you target the network (staging or production) the client is authorized for.

akamai purge --edgerc ./.edgerc --network production invalidate https://www.example.com/app.js

How to prevent it

• Grant the API client the CCU (Fast Purge) API with read-write.
• Scope the client to the properties and network you purge.
• Keep .edgerc credentials in CI secrets, not in the repo.

Frequently asked questions

Related guides

References

• GitHub Actions documentation