# Openapi GET Backups always returns 403 forbidden **URL:** \ **Category:** Ignition\ **Tags:** ignition83, webdev\ **Created:** [May 27, 2026, 10:00pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741 "2026-05-27T22:00:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![derek.delizo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/derek.delizo/32/84136_2.png) [@derek.delizo](https://forum.inductiveautomation.com/u/derek.delizo)\ **Post date:** [May 27, 2026, 10:00pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741/1 "2026-05-27T22:00:22Z")
I am messing around with the Ignition api and am trying to download a gateway backup using curl. I created an API key in my ignition gateway and I am exporting the key in my shell using `export API_TOKEN`. When I make my curl request to the gateway, I get a 403 forbidden response. I don't understand why or how to fix it. I tried creating a new security level under authenticated and that didn't work. I can't assign my API key to the Admin security level. What do I need to do? Here is my curl command: ```bash curl -v \ -H "X-Ignition-API-Token: $API_TOKEN" \ -o gateway-backup.gwbk \ "http://$GW_ADDR:8088/data/api/v1/backup" ``` ---
**Author:** ![Marcus\_Sysum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/marcus_sysum/32/57944_2.png) [@Marcus\_Sysum](https://forum.inductiveautomation.com/u/Marcus_Sysum)\ **Post date:** [May 27, 2026, 10:43pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741/2 "2026-05-27T22:43:43Z")
Did you deselect the check box when creating the api token. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/8/18a58be90ca12c7879d2131fc7133860a7252b77.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 27, 2026, 10:46pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741/3 "2026-05-27T22:46:05Z")
Oy! Crazy-talk! ---
**Author:** ![bmusson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bmusson/32/87530_2.png) [@bmusson](https://forum.inductiveautomation.com/u/bmusson)\ **Post date:** [May 27, 2026, 11:40pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741/4 "2026-05-27T23:40:42Z")
> [@pturmel](#): > > Crazy-talk! Eh. 1. You should absolutely be using TLS. 2. You may still need to turn this checkbox off if you're terminating TLS at a reverse proxy. ---
**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\ **Post date:** [May 28, 2026, 3:06pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741/5 "2026-05-28T15:06:42Z")
We're limited in how much assistance we can be without knowing how you've configured the API Key, Security Levels, and Read Permission settings within your security-properties resource (via the Platform \> Security \> General Settings page). Verify: 1. Some Security Level exists which you can use for this API Key. Ideally, this Security Level would be unused by anything else. 2. Your security settings have the security level from step 1 checked for Gateway Read Permissions, and you've saved that setting. 3. The API Key itself must have the Security Level from 1 checked and saved 4. The token you are using is correct (may warrant making a new token to be sure). ---
**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\ **Post date:** [May 28, 2026, 3:16pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741/6 "2026-05-28T15:16:53Z")
Also, as an alternative to un-checking the secure connections setting for the key, have you tried using that token against the HTTPS port configured for your Gateway? If the "Require secure connection" checkbox is checked, the token will only work against requests coming through the HTTPS port. Verify SSL/TLS is enabled, then hit that HTTPS port and see if you get the desired result. ---
**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\ **Post date:** [May 28, 2026, 3:25pm UTC](https://forum.inductiveautomation.com/t/openapi-get-backups-always-returns-403-forbidden/115741/7 "2026-05-28T15:25:12Z")
Finally... the `API_TOKEN` variable must contain the FULL token. > So the header value itself ( `API_TOKEN` ) has to be `:`, where: > > - `` is the _name_ of the API Key resource as configured in **Platform → Security → API Keys** (it's the map key used to look the token up). > > - `` is the random Base64-url string that `POST /data/api/v1/api-token/generate` returned in the `key` field (see `ApiTokenRoutes.java:74-78`) — e.g. `p3wRdNxufWgMbovC14yPkr9o_GKJlno-K7c99LKexSo`. > > If `$API_TOKEN` is **just the `key` value** with no colon in it, the very first guard (Ignition platform code) fails, `validateRequest` returns `Optional.empty()`, the request is treated as unauthenticated, and the route's `requirePermission(READ)` check returns 403 — the same symptom as the HTTPS issue. (thanks, Claude)