# Transactions throwing 403 Forbidden

**URL:** <https://discuss.elastic.co/t/transactions-throwing-403-forbidden/133646>\
**Category:** APM\
**Created:** [May 29, 2018, 9:03am UTC](https://discuss.elastic.co/t/transactions-throwing-403-forbidden/133646 "2018-05-29T09:03:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sagartalla](https://avatars.discourse-cdn.com/v4/letter/s/9fc29f/32.png) [@sagartalla](https://discuss.elastic.co/u/sagartalla)\
**Post date:** [May 29, 2018, 9:03am UTC](https://discuss.elastic.co/t/transactions-throwing-403-forbidden/133646/1 "2018-05-29T09:03:47Z")

</div>

This api is resulting in http:// **.** \*.com/v1/client-side/transactions 403 Forbidden.  
On the local machine it is working fine.

I find this in the apm-server logs

```auto
2018-05-29T07:14:48.393Z	ERROR	[request]	beater/handlers.go:384	error handling request	{"request_id": "01e195a0-f20e-4942-98e7-b4fcee146ec1", "error": "forbidden request"}
2018-05-29T07:14:48.393Z	INFO	[request]	beater/handlers.go:150	handled request	{"request_id": "01e195a0-f20e-4942-98e7-b4fcee146ec1", "response_code": 403, "method": "POST", "URL": "/v1/client-side/transactions", "content_length": 1621, "remote_address": "127.0.0.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36"}

```

Not able to figure out why this is happening and how to debug. Both(local and the server) have the configuration

---

<div class="post-metadata">

**Author:** ![jalvz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jalvz/32/45613_2.png) [@jalvz](https://discuss.elastic.co/u/jalvz)\
**Post date:** [May 29, 2018, 9:52am UTC](https://discuss.elastic.co/t/transactions-throwing-403-forbidden/133646/2 "2018-05-29T09:52:58Z")

</div>

Hi, thanks for the report.

There are 2 likely causes for that:

One is that frontend is disabled (which is the case by default); for that you need to set apm-server.frontend.enabled = true in the apm-server.yml configuration file.  
When starting the apm-server you should see something like "Frontend endpoints enabled".

The other one is that the request might be rejected for having the wrong CORS headers; you can whitelist any origins in the config option apm-server.frontend.allow\_origins.  
By default is ["\*"], which means that all origins are allowed.

Let me know if this helps!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2018, 6:06am UTC](https://discuss.elastic.co/t/transactions-throwing-403-forbidden/133646/3 "2018-06-19T06:06:40Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.