firewall_denied

{
  "meta": {
    "requestId": "req_3k2j1h0g9f8e7d6c"
  },
  "error": {
    "code": "err:frontline:client:firewall_denied",
    "message": "Forbidden"
  }
}

​

If you’re calling an API hosted on Unkey

​

If you own this API

• A match expression is broader than you meant and catches real traffic.
• An earlier policy is too broad and blocks traffic before a later one runs.
• A firewall policy has no match expressions, so it blocks everything.

​

How to fix

1. Review the policy’s match expressions in the gateway settings and narrow the one that catches real traffic.
2. Reorder your policies if an earlier one is too broad.
3. Create a new deployment. The running deployment keeps the policies it started with.

​

Related errors

• err:frontline:client:insufficient_permissions: a 403 from a key-auth permission query rather than a firewall rule.
• err:frontline:client:openapi_validation_failed: the request was rejected for not matching the OpenAPI spec.