# access_denied

> Access was denied

- Status: 401 Unauthorized (/api/public) · 302 Found (The account connection (/oauth))
- Returned by: /api/public · The account connection (/oauth)
- Operations: [getNextUnreadSettlement](https://developers.rivr.io/reference/api-public/getNextUnreadSettlement.md)
- Retry (`retryWhen`): `after_fix`
- Did anything happen? (`outcome`): `none` (It did not happen)
- Access and organisation
- Page in the portal: https://developers.rivr.io/errors/access_denied
- Try it: `GET https://developers.rivr.io/errors/simulate/access_denied` answers with the code's exact wire form; `?succeedAfter=N&attempt=K` gives a 200 once `attempt` passes `N`; `?surface=api-public|oauth` picks the surface that answers (`api-public` without it)

## What it means

In `/api/public`: the token is valid but doesn't give access to what the call is about, for example a settlement that doesn't belong to the token's clinic. Nothing was read or changed. In the account connection: the person cancelled on Rivr's page, and the browser comes back to your address with `?error=access_denied&state=…`. Nothing is connected.

## What your system does

In `/api/public`: check that the call is made with the token for the clinic that owns the resource. In the account connection: check `state`, show that the connection was cancelled and let the person start over from `GET /oauth/authorize`.

## Is it worth retrying?

No, not without changing the call.

`retryWhen`: `after_fix`. Change the request first, as the code's page says: a value, the token, a header or a new key. Then send it.

## Did anything happen?

`outcome`: `none`. **It did not happen.** This call did not do what you asked for and changed nothing else that you can see or that concerns money. Where the code has an `outcomeNote`, it takes precedence.

## Example: /api/public

```http
HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
  "propertyName": null,
  "message": "The merchantId in the token does not have access to this Order Settlement",
  "errorCode": "access_denied",
  "code": "access_denied",
  "type": "https://developers.rivr.io/errors/access_denied"
}
```

## Example: The account connection (/oauth)

```http
HTTP/1.1 302 Found
Location: https://journal.example.com/rivr/callback?error=access_denied&state=example-state-from-your-session-32-bytes
Cache-Control: no-store
```

The `title`, `detail`, `message` and `error_description` texts are exactly as the API writes them today.