CheckcraftPostman errors 401, 403, 405 and 415: what they mean and how to fix them
Checkcraft is a desktop app for checking APIs and logs without code, with a free edition. Download, no sign-up →
A request from Postman returns a 4xx and everything matches the documentation. Each code has a typical cause, and it is usually visible on one of the request tabs.
401 Unauthorized: the server did not recognize you
The token is missing, wrong or expired. Open the Authorization tab: is the right type selected rather than No Auth? If the token comes from a variable like {{token}}, check that an environment is selected and holds a value: Postman highlights unknown variables. For Bearer, the word Bearer before the token matters. The token expiry is visible when you decode it.
403 Forbidden: recognized but not allowed
The server knows who you are, but this user or token lacks permission for the operation: wrong role, wrong scope, an IP restriction or someone else’s resource. Retry as a user with the right permissions. If a clearly permitted action also returns 403, check which environment the token was issued for.
405 Method Not Allowed: wrong method for this URL
This URL does not support the method: for example, a POST sent to a single object URL or a GET to an endpoint that only accepts POST. Compare the method and path with the documentation, including a trailing slash. Servers often list the allowed methods in the Allow response header.
415 Unsupported Media Type: the server did not understand the body format
The body is in a format the server does not expect. For JSON, choose raw and the JSON type on the Body tab: Postman then sets Content-Type: application/json itself. If the server expects form-data or x-www-form-urlencoded, choose those. Check the Headers tab, including hidden automatic headers: a manually set Content-Type may override the right one.
How not to hit this again after every release
Save requests with their expected codes: a valid request should give 200, one without a token 401, one for someone else’s resource 403. In Checkcraft such checks are saved as status code rules and run as a set.
Repeat this on your own API
Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.
Download FreeDownload and first runNo sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.
References
Start with the linked example and compare its result with your own test requirement.