# A042 - 403 - Forbidden on INT

**URL:** <https://developer.community.nhs.uk/t/a042-403-forbidden-on-int/14242>\
**Category:** e-Referral Service FHIR API\
**Tags:** fhir\
**Created:** [11 August 2026 10:27 UTC](https://developer.community.nhs.uk/t/a042-403-forbidden-on-int/14242 "2026-08-11T10:27:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jim.brock](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/jim.brock/32/368_2.png) [@jim.brock](https://developer.community.nhs.uk/u/jim.brock)\
**Post date:** [11 August 2026 10:27 UTC](https://developer.community.nhs.uk/t/a042-403-forbidden-on-int/14242/1 "2026-08-11T10:27:19Z")

</div>

Hi,

I’m trying to call the A042 - Get Document API call but I’m getting a 403 - Forbidden error.

I can’t see what I’m doing wrong. Here are some details:

[https://int.api.service.nhs.uk/referrals/FHIR/R4/Binary/6b0c6f91-f0db-40f7-9dd0-e8c2dfb1b5bb](https://int.api.service.nhs.uk/referrals/FHIR/R4/Binary/6b0c6f91-f0db-40f7-9dd0-e8c2dfb1b5bb)

XCorrelationId: 7F0E0798-8AED-FE40-AF58-2AFFDFE70510

The error I’m getting is:

```auto
{"resourceType": "OperationOutcome","meta": {"lastUpdated": "2026-08-11T10:17:13.584Z","profile": ["https://www.hl7.org/fhir/R4/operationoutcome.html"]},"issue": [{"severity": "error","code": "forbidden","diagnostics": "Cannot generate shared URL for download from location: nhsd-ers-fileattachments-int-staging, upload ID 162817","details": {"coding": [{"system": "https://fhir.nhs.uk/CodeSystem/http-error-codes","code": "REC_FORBIDDEN"}]}}]}

```

I’m passing a valid OAuth token in the Authorization header.

Do I need to get this API added to our authorised list?

Thanks in advance.

Jim Brock

---

<div class="post-metadata">

**Author:** ![JamesG](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@JamesG](https://developer.community.nhs.uk/u/JamesG)\
**Post date:** [11 August 2026 11:46 UTC](https://developer.community.nhs.uk/t/a042-403-forbidden-on-int/14242/2 "2026-08-11T11:46:14Z")

</div>

I’m having the same issue.

---

<div class="post-metadata">

**Author:** ![tony.marsh1](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/tony.marsh1/32/855_2.png) [@tony.marsh1](https://developer.community.nhs.uk/u/tony.marsh1)\
**Post date:** [12 August 2026 08:53 UTC](https://developer.community.nhs.uk/t/a042-403-forbidden-on-int/14242/3 "2026-08-12T08:53:07Z")

</div>

Hi both, the issue should now be fixed if you wish to re-test

---

<div class="post-metadata">

**Author:** ![jim.brock](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/jim.brock/32/368_2.png) [@jim.brock](https://developer.community.nhs.uk/u/jim.brock)\
**Post date:** [12 August 2026 10:54 UTC](https://developer.community.nhs.uk/t/a042-403-forbidden-on-int/14242/4 "2026-08-12T10:54:26Z")

</div>

That’s working for my now thanks!