Vault "Error making API request ... Code: 403" in CI

By Kaveh Alemi·Latchkey

A 403 from Vault means authentication succeeded but authorization failed. The identity is known; its policies (or the namespace it is scoped to) do not permit this specific request.

What this error means

A CLI or API read returns "Error making API request ... Code: 403" with "* permission denied" or a namespace error in the body.

Error making API request.

URL: GET https://vault.example.com/v1/secret/data/ci/app
Code: 403. Errors:

* permission denied

Common causes

The policy does not cover the operation

The token can log in but its policies do not grant read/list on the requested path, so Vault denies the operation with 403.

The request targets the wrong namespace

On Vault Enterprise, a token issued in one namespace reading a path in another (without VAULT_NAMESPACE set) is not authorized there.

How to fix it

Confirm and grant the required capability

1. Run vault token capabilities <path> to see what the token may do.
2. Add the missing capability to the role policy and reattach it.
3. If Enterprise, set VAULT_NAMESPACE to the namespace that owns the path.

vault token capabilities secret/data/ci/app
# then add "read" in the policy and:
vault write auth/approle/role/ci token_policies="ci-read"

Set the namespace for Enterprise

A 403 on Enterprise is often a missing namespace, not a policy gap.

env:
  VAULT_NAMESPACE: team-ci

How to prevent it

• Grant least-privilege policies scoped to the exact CI paths.
• Pin VAULT_NAMESPACE explicitly on Enterprise so every call targets the right namespace.
• Distinguish 403 (authz) from 400 missing token (no auth) when triaging.

Frequently asked questions

Related guides

References

• GitHub Actions documentation