API permission error 403

henryl

I'm trying to migrate data from WHD using an online migration tool via usrname & AIP key method, but keeping getting permission error 403.

I made the WHD URL publicly accessible via specific IPs and ensure I use WHD Admin account for the API but I still get 403 error. Any suggestions?

jeremymayfield

A 403 Forbidden error in (WHD) usually means that while your credentials (Username + API Key) are technically valid, the account is restricted from accessing the specific API resources or the server itself is rejecting the handshake at a layer above the application.

Since you are already using an Admin account, the issue likely resides in one of the following "hidden" configuration areas:

In WHD, an "Admin" is often a Tech with administrative privileges. API keys are tied to the Tech record, not just the login.

• The Fix: Go to Setup > Techs > Techs. Select the account you are using.
• Ensure that the API Key displayed there is the one you are using. If you recently changed passwords or roles, click Generate to create a fresh key.
• Verify the tech has the "Administrator" checkbox checked under their account settings.

Even an admin account can have its "Permission Set" restricted.

• Go to Setup > Techs > Tech Permissions.
• Locate the permission set assigned to your migration account.
• Ensure that API Access is not restricted and that the account has "Manage" or "Read" access to all modules you are trying to migrate (Tickets, Assets, Clients).
• Check the Limit to Assigned Tech Groups setting; if enabled, the API may block requests for data outside that tech's specific group.

WHD has a global setting that can sometimes interfere with external tools if the authentication method is strictly enforced.

• Go to Setup > General > Authentication.
• Ensure that the Authentication Method is set to a mode that supports API keys (typically "Web Help Desk" or "LDAP").
• Check if there are any Session Timeout settings or Max Authentication Attempts that might have locked the "API identity" out due to high-frequency polling from the migration tool.

If your WHD instance is running on HTTPS (port 8443 by default), the migration tool might receive a 403 if it cannot validate the SSL certificate or if there is a mismatch in the "tomcat" alias in your Java Keystore.

• Fix: If you are using a self-signed certificate, the migration tool may need the certificate ignored or manually imported into its own trusted store.
• Check your whd.conf file to ensure the KEYSTORE_PASSWORD matches the actual certificate password.

5. Check the "whd.log"

The most definitive way to find the cause is the server-side log. It will tell you if the 403 is coming from the Application (permission denied) or the Web Server/Tomcat (protocol denied).

• Navigate to your WHD installation directory: \WebHelpDesk\logs\whd.log.
• Look for the timestamp of your failed migration attempt. It will usually provide a stack trace or a reason like Access denied for tech: [Username].