enter image description hereI'm having an issue getting a positive response(200 code) when making a callout to SBA API. I use the same authentication headers and endpoint in Postman and the response is successful.

However, currently that's not the case for me in Salesforce. Below is my callout method code. The JSON is in a separate method. I have tried to do the callout without the body and headers and still receive the same response code. Anyone ever run into this issue and resolved it?


public static String makeCallout(String jsonstring) {
    //call out logic here
    ETranDetails__c etranDetails = ETranDetails__c.getOrgDefaults();
    HttpResponse response;
    Http http = new Http();
    HttpRequest request = new HttpRequest();
    request.setHeader('Authorization', etranDetails.API_Key__c);
    request.setHeader('Vendor-Key', etranDetails.Vendor_Key__c);
    request.setHeader('Content-Type', 'application/json');
    response = http.send(request);
    return null;
  • 403 means you trying to access something you dont have permission to. So check if the authorization and vendor-key parameters are correct Aug 3, 2020 at 16:48
  • Nagendra, the authorization key and vendor key that I'm using in Salesforce are completely identical to what I use in Postman. Postman returned a positive response. Aug 3, 2020 at 17:01
  • 403 is a response being sent to you from the other system, you should check with them, or ensure that you are actually providing the service with the credentials you think you're providing. Aug 3, 2020 at 17:01
  • Can you share a screenshot of PostMan with the header details ? you can erase the authentication key if you want. Aug 3, 2020 at 17:04
  • Nagendra, I added a picture of the headers for Postman and abbreviated the api and vendor keys. Note: Please ignore the bad request message. That happens if I do a call with the same data back to back. The first response is always a 200 response code. Aug 3, 2020 at 17:41

2 Answers 2


You may have messed up the authorization header. The documentation shows:

Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b

Which means you probably meant to:

request.setHeader('Authorization', 'Token '+etranDetails.API_Key__c);
  • sfdcfox, it would be nice if that was the case. My custom setting field, API_Key__c, has Token included just as the documentation instructs. Aug 3, 2020 at 17:32

After comparing my Postman setup to my Apex code again, I realized that my endpoint was missing the "/api/ppp_loan_forgiveness_requests/" section at the end. After making that change, I no longer receive the 403 error code. Now I receive the 400 error code. That said, this question is resolved I say as 400 is a different issue(field validation). Thanks for the assistance everyone.

  • you should mark this as the answer
    – cropredy
    Jan 29, 2022 at 1:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .