Can someone please guide me how to resolve the access forbidden 403 status code error ? What can i do to at least hit the end point? I am executing the code anonymously in developer console

string algorithmName = 'HMAC-SHA256';
string accessKeyID = 'XX000';
string secretAccessKey = 'XXXX';
string host = 'http://XXXXX:XXXX';
string endpoint = '/api/xxx/xxx';
string S1DealerId = 'XXOHX';
string contenttype = 'application/json';    
Datetime requestedDate = datetime.now(); 
string timestamp  = requestedDate.formatGMT('EEE, dd MMM yyyy HH:mm:ss' + ' ' 
+ 'zzz').tolowerCase();
String requestbody='';
string jsonresponse;
string httpVerb = 'GET';

//string strmd5= EncodingUtil.base64Encode (Crypto.generateDigest('MD5', Blob.valueOf(requestbody)));
//string contentmd5 = strmd5.toLowerCase();
//system.debug('CONTENT-MD5 is: ' +contentmd5);

string encodedURIPath = '' + endpoint + '\n'; 

string canonicalizedResource = encodedURIPath;

List<String> headerList = new list<String> { 'X-SourceOne-Act-As-Dealership' , 'X-SourceOne-Partner-User-ID' , 'X-SourceOne-User-ID' ,'X-SourceOne-Act-As- Dealership-Partner-ID' };
string canonicalizedHeader = headerList[0].toLowerCase() + ':' + 
R1DealerId.trim() ;

//If the request has no body and there is no Content-MD5 HTTP header included 
in the request, an empty string will be used here.
string stringToSign =   'GET' + '\n' + '\n' +
                            contenttype + '\n' +
                            timestamp + '\n' +
                            canonicalizedHeader + '\n' + 

    system.debug('The stringToSign is :' + stringToSign);

    Blob mac = Crypto.generateMac('HMAC-SHA256', blob.valueOf(stringToSign),blob.valueOf(secretAccessKey));
    String signature = EncodingUtil.base64Encode(mac);

    String authorization_header = 'SourceOne' + ' ' + accessKeyID + ':'+signature;
    system.debug('Authorization Header: '+authorization_header );

    HttpRequest request = new HttpRequest();
    HttpResponse res = new HttpResponse();
    Http http = new Http(); 

    request.setEndpoint(host + endpoint); 

    request.setHeader('Authorization', authorization_header);

    res = http.send(request);

    system.debug('Retrieved status message and status code returned in the response: ' + res.toString());
   system.debug('Retrieved STATUS_MESSAGE returned for the response: ' + res.getStatus());
   system.debug('Retrieved STATUS_CODE returned for the response: '+res.getStatusCode());

    jsonresponse = res.getBody();    
    system.debug('Capturing response body in a string: ' + jsonresponse);
  • You just exposed your secret access key to the Internet. Please go revoke and replace it immediately.
    – David Reed
    Jun 17, 2019 at 20:40
  • @DavidReed Thanks for diligently bringing it to my notice. the secret access key is not the actual key i posted. Jun 17, 2019 at 20:46
  • The 403 is coming from AWS, right? Might want to try another forum.
    – identigral
    Jun 17, 2019 at 21:06
  • Its an external system (not AWS) that i am sending the request to. My request is not reaching the endpoint, as its not seen in the debug logs at the other end. So i am not sure what is throwing the 403 error. Jun 17, 2019 at 21:16

1 Answer 1


Resolved the issue..

The webservice my Apex code was trying to invoke is hosted on a server that can't be accessed from outside the organization. The firewalls restrict API calls coming from outside of the network. As as result Salesforce (which is on the cloud) was unable to access that webservice. Resolution: We migrated the web service to an environment which is hosted on the server that allows calls from the internet. In this environment, we use a two way SSL and a stringent authentication mechanism to be able to get the response


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .