| Protocol | ims | Network | 5G and LTE |
|---|---|---|---|
| Spec | RFC 3261 / 3GPP TS 24.229 | Spec Section | SIP 403 Forbidden policy or authorization failure in IMS |
| Direction | IMS network -> UE | Message Type | SIP request-failure response |
| Full message name | IMS SIP 403 Forbidden |
|---|---|
| Protocol | IMS |
| Technology | 5G and LTE |
| Common deployment | VoNR and VoLTE |
| Direction | IMS network -> UE |
| Interface | Gm with onward IMS routing |
| Signaling bearer / channel | IMS SIP signaling / Final request-failure response |
| Typical trigger | The user or request is not allowed by service policy. |
| Main purpose | Stops processing when policy, authorization, barring, or service restrictions prevent acceptance. |
| Main specification | RFC 3261 / 3GPP TS 24.229, SIP 403 Forbidden policy or authorization failure in IMS |
| Release added | See specification history |
| Procedures where used | IMS Registration Failure, IMS Session Rejection, VoNR Failure Handling, VoLTE Failure Handling |
403 Forbidden means the request was understood but the network or service refused to allow it.
Stops processing when policy, authorization, barring, or service restrictions prevent acceptance.
403 means the request was understood but not allowed.
Previous message(s): IMS SIP REGISTER, IMS SIP INVITE
Next message(s): Procedure stop or alternate handling
Security context: Often appears after authentication when the problem is policy rather than credentials.
SIP/2.0 403 Forbidden
Via:
From:
To:
Call-ID:
CSeq:
Warning: OPTIONAL
Content-Length: 0
This is SIP response syntax rather than ASN.1.
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP ue.example.net;branch=z9hG4bK-reg2
From: <sip:alice@example.net>;tag=reg2
To: <sip:alice@example.net>;tag=pcscf1
Call-ID: reg-001@example.net
CSeq: 2 REGISTER
Content-Length: 0
| IE | Required | Description |
|---|---|---|
Status-Line | Yes | Shows the 403 failure code. |
Warning | Optional | Can provide extra policy or service context. |
Status-LineShows the 403 failure code.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
WarningCan provide extra policy or service context.
Presence: Optional
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
Likely cause: The issue is policy, barring, user authorization, or service permissions.
What to inspect: Check whether the service profile and user policy actually allow the request.
Next step: Treat 403 as a policy refusal unless the trace proves a different cause.
It means the request was understood, but policy or service authorization did not allow it.
Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.