The Okta Access Gateway (OAG) Monitoring REST API endpoint returns a 403 Forbidden error when the allowed IP list lacks the client IP address. Resolve this error by adding the client IP address or the IP address from the X-Forwarded-For header to the allowed IP list in the OAG admin node. The OAG Monitoring REST API endpoint (/basic_status) returns the following HTTP error response:

403 Forbidden

• Okta Access Gateway (OAG)
• REST API Monitoring
• Okta Identity Engine (OIE)
• Okta Classic Engine

The allowed IP list lacks the client IP address or the IP address from the X-Forwarded-For header. When a load balancer passes an IP address in an X-Forwarded-For header, OAG considers the originating IP address the real IP and requires it in the allowed list. The load balancer IP address does not require inclusion in the allowed list.

What steps resolve the 403 Forbidden error?

Verify the load balancer configuration and add the client IP address to the allowed IP list in the OAG admin node.

1. If a load balancer exists in front of OAG, check the configuration to see if it passes the client IP address in an X-Forwarded-For header.
2. Ensure the IP address is included in the allowed IP list.
   1. Secure Shell (SSH) to the OAG admin node.
   2. Select 4 - Monitoring.
   3. Select 5 - Configure REST APIs.
   4. Select 3 - Manage allowed IPs.
   5. If necessary, add the client IP address or the IP address passed in the X-Forwarded-For header.

Related References

• Manage REST API Monitoring
• Basic REST API Monitoring