403 would be the proper status if the user was authenticated but forbidden. 503 would imply an error on the server and that the service is unavailable.<p>Here the 403 is appropriate because the user is logged in and trusted to some degree by your system, but isn&#x27;t allowed to access that URI.<p>If the user were unauthenticated and tried to access the same URL, he should get a 401 for Unauthorized, which is the same response he should get for every URI in your system, thus exposing nothing about your underlying service.