Skip to main content

Error 403 — Collections

Problem summary​

A call to the Collections API that contains a payload similar to the one below indicates that the token itself was formed correctly and reached our server. However,

{
	"type": "https://tools.ietf.org/html/rfc7231#section-6.5.3",
	"title": "Forbidden",
	"status": 403,
	"traceId": "00-4bcbceb92f9ae14918978f0c8babda94-7a86858ef4784b8f-01"
}

Common causes​

Operating on a collection of another company​

The API validates that the companyId provided in the route corresponds to the company in the token. Trying to operate on collections of a CNPJ different from the one consented will return 403.

Confirm that the companyId used in the URL (/{companyId}/banking/collections/...) is the same CNPJ of the company authenticated in the token.

Incorrect data in the account field​

The API checks the data provided in account.number and account.branch to validate whether it matches what is in the banking system. If incorrect data or data from other accounts is provided, the response will be 403. It is important that the data provided matches what is in Retrieve account data, that is, with leading zeros, with the check digit, and without a hyphen.

Quick diagnosis​

  1. Decode the token at jwt.io
  2. Check that the scope field contains brn:btg:empresas:banking:collections
  3. Check that the aud claim is filled with the company's CNPJ
  4. Confirm that the companyId in the URL matches the CNPJ in the token
  5. Confirm that the account.number and account.branch data match what is available via Retrieve account data

If the problem persists after these steps, contact the support team by email at ImplantacaoEmpresas@btgpactual.com.