SIP 403 Forbidden

What SIP 403 means

Your credentials were accepted but the action was not allowed. A 403 means the system knows who you are and is still refusing, so look at permissions rather than passwords: call barring, an outbound caller ID you are not entitled to present, or a source IP address the trunk does not recognise.

Client error (4xx)
Sent by Registrar, proxy, or the carrier session border controller
Common

What SIP 403 Forbidden actually means

The server understood the request and is refusing to fulfil it, and re-sending the same request will not help. This is the key difference from a 401 or 407: those invite you to try again with credentials, whereas a 403 is a settled decision. On a hosted phone system it is a policy refusal rather than an identity problem.

What causes SIP 403 on a business phone system

The destination is barred on your accountPremium rate, international and directory-enquiry ranges are barred by default on most UK business accounts, and a barred range answers with a 403 rather than connecting. This is the first thing to check when one type of number fails and everything else works.
Your public IP address is not on the trunk allow-listWhere a trunk authenticates by IP rather than by registration, a change of public IP breaks it instantly. A business on a dynamic address can be working one day and getting a 403 on every call the next, purely because the broadband line reconnected with a different address.
The outbound caller ID is not a number you ownPresenting a CLI that is not assigned to your account is refused, and UK carriers have tightened this considerably. It typically appears after someone sets a number in the PBX by hand, or after a number has been ported away but left configured.
The account is suspended or over its credit limitA suspended account or an exhausted prepay balance often refuses calls with a 403 while still allowing registration, which makes it look like a technical fault rather than a billing one.
Registration is blocked by geographic or fraud rulesProviders commonly refuse registrations from countries a business does not operate in. Staff travelling abroad with a softphone hit this, as does anyone routing through a VPN that exits in another country.

How to fix SIP 403

Work out whether it is every call or only someIf internal calls work and one destination type fails, you are looking at call barring or a route. If nothing works at all, look at the trunk, the IP allow-list or the account status. This single check saves most of the diagnosis.
Compare your current public IP with the one on the trunkCheck what address you are presenting and confirm it matches the allow-list your provider holds. If your line has a dynamic address, ask for a static one or move the trunk to registration-based authentication so the problem cannot recur.
Verify the outbound caller ID against your assigned numbersEvery number the PBX presents must appear on your account. Remove any that were typed in manually or that belong to a number you have since given up.
Check call barring and the account balance in your provider portalAsk for the specific bar to be lifted if the destination is one you legitimately need. Where barring exists to control fraud, lift it for the range you need rather than switching it off altogether.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SIP 403

What does SIP 403 Forbidden mean on a VoIP phone?

It means the system recognised your credentials and still refused the request. Because identity is not in question, the cause is a permission: the number you dialled is barred, the caller ID you are presenting is not one you own, your source IP address is not recognised by the trunk, or the account itself is suspended.

Why do I get SIP 403 after changing broadband provider?

Almost always because your public IP address changed. Trunks that authenticate by IP hold an allow-list, and the moment your line reconnects on a different address every call is refused. Send your provider the new address, and ask to move to registration-based authentication or a static IP so it cannot happen again.

Is SIP 403 a password problem?

No, and that distinction matters because it stops you changing passwords for no reason. A wrong password produces a repeating 401 or 407. A 403 means authentication already succeeded and the refusal is about what your account is permitted to do.

Why can I make some calls but not others?

That pattern points at call barring or a missing route rather than anything wrong with the phone. Premium rate, international and directory-enquiry ranges are barred by default on most UK business accounts. Check which ranges are barred on your account and have the specific range you need opened up.

Call hangup causes that become SIP 403

If the call crossed a gateway between SIP and ISDN or SS7, this status may have started life as one of these Q.850 cause values. The mapping is defined in RFC 3398 section 7.2.4.1.

Related SIP response codes

Source. SIP 403 Forbidden is defined in RFC 3261 section 21.4.4 and registered in the IANA SIP Parameters — Response Codes. The causes and fixes above are drawn from our own experience supporting UK business phone systems.

All VoIP & SIP codes