HTTP 403 Forbidden
Type URI: https://public.api.connect.skoda-auto.cz/problems/operation-not-authorized
When it occurs
The API key is valid and covers the vehicle, but the vehicle refused the operation for the user the key belongs to.
This is rare, because a user who lacks the rights for an operation is normally answered with
operation-disabled (422) before the
operation is ever sent. That check is skipped when the rights cannot be resolved at that moment,
and the refusal then comes from the vehicle instead. The rights changing between the check and the
operation has the same effect.
Losing access to a vehicle is not one of the causes: it revokes the keys bound to it, so those
answer 401. Neither is
api-key-not-authorized, which answers a
request for a vehicle the key does not cover at all. Creating a new key resolves neither this
problem nor those.
The instance member identifies the request the problem is about.
Example response
{
"type": "https://public.api.connect.skoda-auto.cz/problems/operation-not-authorized",
"title": "Forbidden",
"status": 403,
"detail": "Not authorized to execute the operation for vehicle TMBJB9NY5RF999999.",
"instance": "/api/v1/vehicles/TMBJB9NY5RF999999/charging/start"
}What to do
Repeating the operation right away will not help. Read the vehicle detail endpoint first: when it
reports the part the operation belongs to as unavailable, errors[] names the reason and
further operations answer 422 until it is resolved - which the vehicle owner can do in the MyŠkoda
app. When the vehicle detail reports the part as available and the operation keeps being refused,
the two disagree; contact support with the instance and the time of the request.