[Question]: Message: Unknown API Status Code! 403

[abinhho]

How can we help?

This code is getting error 403. I believe key and appId was not wrong because I used them on https://documentation.onesignal.com/reference/update-user?playground=open#parameter-app-id and API was called successfully.

Code

import * as OneSignal from '@onesignal/node-onesignal';

const appId = 'app id here';
const restApiKey = 'key here';
const organizationApiKey = 'key here';

export const oneSignalUpdateUserProperty = async (params: {
  userId: string;
  propertyName: string;
  propertyValue: any;
}) => {
  const configuration = OneSignal.createConfiguration({
    restApiKey,
    organizationApiKey,
  });

  const client = new OneSignal.DefaultApi(configuration);

  try {
    return client.getUser(appId, 'external_id', params.userId);
  } catch (err) {
    console.error('Error getting user:', err);

    return false;
  }
};

Error details:

Error: HTTP-Code: 403
Message: Unknown API Status Code!
Body: {}
Headers: {"access-control-allow-headers":"OneSignal-Subscription-Id","alt-svc":"h3=\":443\"; ma=86400","cf-cache-status":"DYNAMIC","cf-ray":"966bc0633bd48149-HKG","connection":"keep-alive","content-encoding":"br","content-type":"text/plain","date":"Tue, 29 Jul 2025 09:57:20 GMT","server":"cloudflare","set-cookie":"__cf_bm=axiu.zu_89lCdHW.xx-1753783040-1.0.1.1-PxDxQ068ruWy_.Lh9Q7jHRuwcQmsjbD.xx.5Gz7JwJhsJ7u6q5qepM8EXFrq.xx; path=/; expires=Tue, 29-Jul-25 10:27:20 GMT; domain=.onesignal.com; HttpOnly; Secure; SameSite=None","strict-transport-security":"max-age=15552000; includeSubDomains","transfer-encoding":"chunked","via":"1.1 google"}

This working fine

const apps = await client.getApps();
console.log(apps);

Please help!

Code of Conduct

• I agree to follow this project's Code of Conduct

[sherwinski]

Hi @abinhho,

I wonder if you've accidentally switched the values of your restApiKey and organizationApiKey variables? That would explain why getApps() call would work but not getUser(). In either case, a 403 status code means there is some kind of authorization issue so I would just confirm that you are passing the correct API keys to the configuration object.

[abinhho]

@sherwinski on my above code, I tried to switch restApiKey to organizationApiKey and vice versa but still getting error.
I also tried to use restApiKey to update user tag by calling direct API via CURL and it works.

[BritOneSignal]

Hi @abinhho,

From what we can see, the 403 is likely happening because the SDK is sending your Organization API Key when calling getUser, which is an app-level endpoint. This endpoint only works with the App REST API Key.

I’d recommend removing the organization key from the configuration entirely for this call, so the SDK can only send the REST key. That will help rule out the org key as the cause and should let the request go through.

Let us know if you still see the error after trying that.

[tushar-majestyk]

Hi @abinhho, how did you resolve this? We are seeing the same problem.

Strangely enough, it's working from a local machine in Europe, while my colleague is getting this error using this from the US.

The only call we're making is to sendNotification

[christopheramason]

The confusion that I had was due to poorly named property labels in the configuration, used to setup the client.
The configuration properties are named organizationApiKey and restApiKey.

In your dashboard, under organizations -> keys & ids, you will be able to create a REST API key. This is the organizationApiKey.

There is also a place under your application -> settings -> keys & ids, where you can create another REST API key. This is the restApiKey that is needed to get users and createNotifications

My suggestion:
Both of the variables should be renamed to properly describe what they are.
organizationApiKey should be updated to organizationRestApiKey
restApiKey should be updated to applicationRestApiKey

[BritOneSignal]

Hi @christopheramason, thank you very much for the feedback 🙏.

I can see how the current property names (organizationApiKey and restApiKey) might be a bit unclear since they both refer to different REST API keys in the dashboard. Your suggestion of renaming them to organizationRestApiKey and applicationRestApiKey would certainly help make the distinction more obvious.

I’ll make sure to share this with our team for consideration. Thanks again for taking the time to provide this input!

[sherwinski]

Separate from the conversation about API keys here I did want to add one thing:

I think the Unknown API Status Code message gets emitted when the library tries to serialize a status code that it doesn't expect. In the original example the API returned a 403 (related to the request's authorization header) on the getUser endpoint however, that status code isn't specifically checked for when we try to serialize the response. I imagine if it were a different response, e.g. 400 or 429, then we would see a more helpful error message.

I've made a note to look into adding more exhaustive error types here (related to #142) so as to hopefully improve this experience.