Getting a 403 that doesn't look like a Postmark error?

What this 403 means

When the Postmark API rejects a request, it returns JSON with an ErrorCode and a Message. If a request you've sent comes back with an HTTP 403 status code and an HTML body instead, it typically means the request was stopped by a network-level security layer in front of the API.

A valid request shouldn't be blocked by this layer. If yours is, contact us and we'll look into it.

What it looks like:

HTTP/1.1 403 Forbidden
Server: [varies]
Content-Type: text/html
Content-Length: 118

<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
</body>
</html>

Note: The Server header, if present, can differ depending on where the request was blocked. The HTML body and the missing ErrorCode are what to look for.

How to tell the difference:

An HTTP status code (like 403) is the standard number a web server sends back to say whether a request succeeded or failed, while an ErrorCode is Postmark’s own number inside the JSON response.

	A Postmark API error	A network-level HTTP 403
Response body	JSON, with an ErrorCode and Message	HTML, or anything without a Postmark ErrorCode
Content-Type header	application/json	Typically text/html
What to do	See API error codes	If your request should be valid, contact support

Integration tips

In your integration, it can help to check that the response body is JSON with an ErrorCode before treating an HTTP 403 status code as a Postmark error. If the body isn’t JSON with an ErrorCode, consider logging the full response (status, headers, and body) and the time of the request.

Contacting support

Contact support and include:

The full response, body and headers
The timestamp of the request, with your timezone
The API endpoint you called
The public IP address your requests come from, if you know it