VoIP.infoThe independent guide to business communications.
VoIP.info SIP response reference

SIP 403 Forbidden

The recipient understood the request but refuses it. This is a policy or authorization rejection; it does not universally mean the password is incorrect.

Reviewed 2026-10-14Foundational

Locate the response family

  1. 1xx ProvisionalRequest is progressing
  2. 2xx SuccessRequest succeeded
  3. 3xx RedirectionAnother destination
  4. 4xx Request failureInterpret this request403 belongs here
  5. 5xx Server failureServer could not fulfil
  6. 6xx Global failureFailure across destinations

Read the status with its request method and call leg. For example, 200 after REGISTER confirms a binding; it does not prove an INVITE succeeded.

What this response means

The recipient understood the request but refuses it. This is a policy or authorization rejection; it does not universally mean the password is incorrect.

Read it in context

Carrier restrictions, unauthorized caller identity, blocked destinations, account state or PBX access policy can produce a refusal. Implementations may use this response in different operational situations.

Administrator checks

Identify the sender and the rejected method. Compare an allowed destination and another authorized extension. Review route permissions, source identity and carrier account status. Keep the timestamp and call identifier for the party issuing the rejection.

Next action and common mistake

Do not repeatedly retry an unchanged forbidden request or open unrestricted calling to make it pass. Correct the specific authorization issue, then verify both an allowed and a prohibited case. Registration and call permission remain separate checks. For Asterisk PJSIP, use the focused 403 investigation.

CompanyFlex can refuse different methods for different identity reasons

On Deutsche Telekom CompanyFlex, a 403 on REGISTER and a 403 on INVITE are separate incidents. The Asterisk PJSIP diagnostic compares registration Contact and account fields first, then assigned calling identities on the exact INVITE. It does not turn the response into a bad-password label or an automatic retry loop.

A Twilio 403 needs its transaction position

For Twilio termination, an initial-INVITE 403 commonly indicates ACL mismatch, while a post-407 authenticated INVITE can expose credential failure. The provider-specific diagnostic then keeps caller ID, geographic permission and other 403 policies separate.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Continue your research

Troubleshooting · Current Sangoma outbound-route guidance, current Asterisk Dial and troubleshooting documentation, and SIP standards reviewed October 5, 2026; no phone, PBX, carrier or live call test

Outbound VoIP calls fail: locate the broken call leg

Classify one failed call, then follow the exact digits through the phone, PBX route, attempted trunk, remote response, answer and media.

Read guide →
Protocol reference

SIP authentication: challenges and modern digest support

Understand the difference between a normal challenge, failed credentials and an unsupported algorithm.

Read guide →
Guide

SIP trunk IP authentication

Understand source-address trust and the consequences of a WAN address change.

Read guide →
Diagnostic · Current Asterisk res_pjsip, authentication and outbound-registration documentation plus RFC 3261 reviewed September 27, 2026; no PBX, endpoint, provider, account, authentication, registration or live-call test

Asterisk PJSIP 403 Forbidden diagnosis

Identify which SIP participant refused which method, then separate digest authentication, registration authorization, AoR contact policy and call-routing policy before changing credentials or retries.

Read guide →
Diagnostic · Current Asterisk PJSIP authentication, endpoint-identification and outbound-registration documentation plus RFC 3261 reviewed September 27, 2026; no PBX, endpoint, provider, account, credential, registration or live-call test

Asterisk PJSIP 401 Unauthorized diagnosis

Decide whether 401 is a normal digest challenge, Asterisk's dummy challenge for an unrecognized endpoint, or a failed response on one exact SIP leg.

Read guide →
Provider research · Deutsche Telekom's current CompanyFlex SIP-Trunk, CompanyFlex overview, interface catalogue, 1TR119 v1.13.0, services and Business Service Portal pages were reviewed October 7, 2026; the current quote, order, portal and implementation record govern, and no account, credential, address, number, port, trunk, PBX, SBC, registration, call, media stream, fax, protected session, failover event, emergency workflow, message, availability, price or support response was inspected or tested

Deutsche Telekom CompanyFlex SIP-Trunk: registration, MediaSec and capacity boundaries

Use the current CompanyFlex order and 1TR119 interface record without turning registration, MediaSec, parallel-call or T.38 capabilities into untested service results.

Read guide →
Troubleshooting · Current Twilio Elastic SIP Trunking configuration, troubleshooting, sending-SIP, CredentialList, Trunk-resource and error-32201 documentation reviewed October 14, 2026; the sources distinguish Termination URI identification, DNS and edge selection, IP ACL and credential authentication, 407 challenge flow, E.164 addressing, caller identity and later account policy, but do not prove one account, trunk, ACL, credential list, source address, DNS answer, route, caller identity, permission, capacity state, packet, media stream or completed call, and none was inspected or tested

Twilio termination call gets no response or 403 Forbidden

Separate Termination URI and DNS reachability from initial-INVITE ACL rejection, post-407 credential failure, E.164 addressing, caller identity, geographic permission and capacity policy.

Read guide →