SIP 403 Forbidden: causes and per-scenario triage

2026-07-13 · sip, troubleshooting

A SIP 403 Forbidden is the server saying “I understood you and I’m refusing.” Unlike 401/407, it is not a challenge to re-send with credentials — resending the same request unchanged gets you another 403.

401 vs 403 — know the difference

• 401 / 407: authenticate and retry with an Authorization / Proxy-Authorization header. Normal handshake.
• 403: the request was authenticated (or auth wasn’t the problem) and still refused. Something about who you are or what you asked for is not allowed.

Common causes

1. From-user / auth-user mismatch. Many proxies require the From user to match the authenticated account. Spoofing checks reject the mismatch.
2. IP / ACL block. The source IP isn’t permitted for this trunk or context.
3. Fraud / rate-limit block. Destination prefix blocked, or too many attempts.
4. Not provisioned for the route. The account exists but isn’t allowed to dial that destination class (international, premium).

Triage

Paste the request and the 403 into the SIP message analyzer. Check:

• Does the From URI user match the auth credentials?
• Is there a Reason or Warning header with a hint?
• On registration, is the Contact sane and the source IP expected?