REST API Reference > Platform REST API version 3 resources > Elastic runtime environments

Elastic runtime environments

Use the ClusterConfig resource to get configuration details for an elastic runtime environment, or to create or update a configuration. You can also read the link between the configuration and the elastic runtime environment.

You can send the following requests:

•To get details about a configuration, send a GET request.
•To create a configuration, send a POST request.
•To update a configuration, send a PUT request.
•To retrieve the association between the configuration and the elastic runtime environment, sent a GET request. You can retrieve either by the elastic runtime environment ID or configuration ID.
•To associate a configuration with an elastic runtime environment, send a POST request.

Getting configuration details

You can request the details for a specific configuration.

GET request

To get configuration details, use the following URI:

/public/core/v3/ClusterConfig/<config_id>

GET response

If successful, returns the following information for a configuration:

Field	Type	Description
id	String	Configuration ID.
orgId	String	ID of the organization the configuration belongs to.
infaManaged	Boolean	Whether the configuration is managed by Informatica.
clusterName	String	Name of the configuration.
description	String	Description of the configuration.
cloudPlatform	String	Cloud platform hosting the configuration.
haEnabled	Boolean	Whether high availability is enabled.
region	String	Region in which the configuration is located.
subnets	Array	Subnets used within the network.
masterNodeInstanceType	String	Instance type to host the master node.
maxWorkerNodes	Integer	Maximum number of worker nodes to use.
minWorkerNodes	Integer	Minimum number of worker nodes to use.
workerNodeIdleTimeout	Integer	Amount of time in minutes before a worker node times out.
workerNodeInstanceType	String	Instance type to host a worker node.
workerNodeVolumeSize	Integer	Volume size of a worker node.
systemDiskConfig	Escaped string representation of JSON	Properties of the system storage, if configured. Includes the file system, source mount, and access point.
dataDisksConfig	Escaped string representation of JSON	Properties of the data storage, if configured. Includes the file system, source mount, and access point.
initScriptPath	String	Not used. An elastic runtime environment doesn't use initialization scripts.
masterNodeIAMRole	String	IAM role for the master node.
workerNodeIAMRole	String	IAM role for the worker nodes.
imageRegistryHost	String	Domain name or IP address of the registry hosting the container images.
imageRegistryUser	String	User name to log into the image registry host.
imageRegistryPassword	String	Password to log into the image registry host.
dateDeployed	Date	Date when the image was deployed.
miscTags	Escaped string representation of JSON	Tags associated with the cloud ecosystem.

GET response example

To get configuration details, use the following request:

GET <baseApiUrl>/public/core/v3/ClusterConfig/<config_id>
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you might receive a response like the following example:

[
{
"id": "5MdLmj0YXoce2osMD2mT0r",
"orgId": "dx7DSOIGiiPh6XQoZKpAmC",
"infaManaged": false,
"clusterName": "test-cluster",
"description": "Description of the cluster",
"cloudPlatform": "AWS",
"haEnabled": false,
"region": "us-west-1",
"subnets": [
"subnet-1",
"subnet-2"
],
"masterNodeInstanceType": "m5.large",
"maxWorkerNodes": 10,
"minWorkerNodes": 1,
"workerNodeIdleTimeout": 5,
"workerNodeInstanceType": "m5.xlarge",
"workerNodeVolumeSize": 100,
"systemDiskConfig": "{\"id\": \"\", \"sourceMount\": \"\", \"accessPoint\": \"\"}",
"dataDisksConfig": "[{\"id\": \"\", \"sourceMount\": \"\", \"targetMount\": \"\", \"accessPoint\": \"\"}]",
"initScriptPath": "/path/to/script",
"masterNodeIAMRole": "masterRole",
"workerNodeIAMRole": "workerRole",
"imageRegistryHost": "registry.example.com",
"imageRegistryUser": null,
"imageRegistryPassword": null,
"dateDeployed": null,
"miscTags": "{\"cloudEcosystemTags\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}],\"runtimeProperties\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}]}"
}
]

Creating a configuration

If you have administrator privileges, you can use the ClusterConfig resource to create a configuration.

POST request

To create a configuration, send a POST request using the following URI:

/public/core/v3/ClusterConfig

Include the following information:

Field	Type	Required	Description
orgId	String	Yes	ID of the organization the configuration belongs to.
infaManaged	Boolean	Yes	Whether the configuration is managed by Informatica. Set to false.
clusterName	String	Yes	Name of the configuration.
description	String	-	Description of the configuration.
cloudPlatform	String	Yes	Cloud platform hosting the configuration. Set to AWS.
haEnabled	Boolean	Yes	Whether high availability is enabled.
region	String	Yes	Region in which the configuration is located.
subnets	Array	Yes	Subnets used within the network. Enter the subnet name, not the subnet ID. Note: The subnets field is dependent on the haEnabled field: - If haEnabled = true, subnets should have two values. - If haEnabled = false, subnets should be empty or null.
masterNodeInstanceType	String	Yes	Leave this field empty.
maxWorkerNodes	Integer	Yes	Maximum number of worker nodes to use.
minWorkerNodes	Integer	Yes	Minimum number of worker nodes to use.
workerNodeIdleTimeout	Integer	Yes	Amount of time in minutes before a worker node times out.
workerNodeInstanceType	String	Yes	Instance type to host a worker node.
workerNodeVolumeSize	Integer	Yes	Volume size of a worker node.
systemDiskConfig	Escaped string representation of JSON	Yes	Properties of the system storage, if configured. Includes the file system, source mount, and access point.
dataDisksConfig	Escaped string representation of JSON	Yes	Properties of the data storage, if configured. Includes the file system, source mount, and access point.
initScriptPath	String	Yes	Not used. An elastic runtime environment doesn't use initialization scripts.
masterNodeIAMRole	String	Yes	IAM role for the master node.
workerNodeIAMRole	String	-	Not used.
imageRegistryHost	String	-	Not used.
imageRegistryUser	String	-	Not used.
imageRegistryPassword	String	-	Not used.
dateDeployed	Date	-	Leave this field empty.
miscTags	Escaped string representation of JSON	Yes	Cloud ecosystem tags and runtime properties. Each tag category is required, but their values can be empty. For example: "miscTags": "{\"cloudEcosystemTags\":[],\"runtimeProperties\":[]}"

POST response

If successful, returns the ClusterConfig object in the POST request.

POST example

To create a configuration, send a request similar to the following example:

POST <baseApiUrl>/public/core/v3/ClusterConfig
Content-Type: application/json
Accept: application/json
INFA-SESSION-ID: <sessionId>
{
"orgId": "dx7DSOIGiiPh6XQoZKpAmC",
"infaManaged": false,
"clusterName": "test-cluster-102",
"description": "Description of the cluster",
"cloudPlatform": "AWS",
"haEnabled": false,
"region": "ap-south-1",
"subnets": [
"subnet-name1",
"subnet-name2"
],
"masterNodeInstanceType": "",
"maxWorkerNodes": 10,
"minWorkerNodes": 1,
"workerNodeIdleTimeout": 5,
"workerNodeInstanceType": "c4.2xlarge",
"workerNodeVolumeSize": 100,
"systemDiskConfig": "{\"id\": \"\", \"sourceMount\": \"\", \"accessPoint\": \"\"}",
"dataDisksConfig": "[{\"id\": \"\", \"sourceMount\": \"\", \"targetMount\": \"\", \"accessPoint\": \"\"}]",
"initScriptPath": "/path/to/script",
"masterNodeIAMRole": "masterRole",
"workerNodeIAMRole": "workerRole",
"imageRegistryHost": "registry.example.com",
"imageRegistryUser": "user",
"imageRegistryPassword": "password",
"dateDeployed": null,
"miscTags": "{\"cloudEcosystemTags\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}],\"runtimeProperties\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}]}"
}

If successful, you might receive a response like the following example:

{
"id": "89Dnw937Al30sN40ia9Oat",
"orgId": "dx7DSOIGiiPh6XQoZKpAmC",
"infaManaged": false,
"clusterName": "test-cluster-102",
"description": "Description of the cluster",
"cloudPlatform": "AWS",
"haEnabled": false,
"region": "ap-south-1",
"subnets": [
"subnet-name1",
"subnet-name2"
],
"masterNodeInstanceType": "",
"maxWorkerNodes": 10,
"minWorkerNodes": 1,
"workerNodeIdleTimeout": 5,
"workerNodeInstanceType": "c4.2xlarge",
"workerNodeVolumeSize": 100,
"systemDiskConfig": "{\"id\": \"\", \"sourceMount\": \"\", \"accessPoint\": \"\"}",
"dataDisksConfig": "[{\"id\": \"\", \"sourceMount\": \"\", \"targetMount\": \"\", \"accessPoint\": \"\"}]",
"initScriptPath": "/path/to/script",
"masterNodeIAMRole": "masterRole",
"workerNodeIAMRole": "workerRole",
"imageRegistryHost": "registry.example.com",
"imageRegistryUser": "user",
"imageRegistryPassword": "password",
"dateDeployed": null,
"miscTags": "{\"cloudEcosystemTags\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}],\"runtimeProperties\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}]}"
}

Updating a configuration

If you have administrator privileges, you can use the ClusterConfig resource to update a configuration.

PUT request

To update a configuration, send a PUT request using the following URI:

/public/core/v3/ClusterConfig/<advanced_config_ID>

Include the following information:

Field	Type	Required	Description
ID	String	Yes	Configuration ID.
orgId	String	Yes	ID of the organization the configuration belongs to.
infaManaged	Boolean	Yes	Whether the configuration is managed by Informatica. Set to false.
clusterName	String	Yes	Name of the configuration.
description	String	-	Description of the configuration.
cloudPlatform	String	Yes	Cloud platform hosting the configuration. Set to AWS.
haEnabled	Boolean	Yes	Whether high availability is enabled.
region	String	Yes	Region in which the configuration is located.
subnets	Array	Yes	Subnets used within the network. Enter the subnet name, not the subnet ID. Note: The subnets field is dependent on the haEnabled field: - If haEnabled = true, subnets should have two values. - If haEnabled = false, subnets should be empty or null.
masterNodeInstanceType	String	Yes	Leave this field empty.
maxWorkerNodes	Integer	Yes	Maximum number of worker nodes to use.
minWorkerNodes	Integer	Yes	Minimum number of worker nodes to use.
workerNodeIdleTimeout	Integer	Yes	Amount of time in minutes before a worker node times out.
workerNodeInstanceType	String	Yes	Instance type to host a worker node.
workerNodeVolumeSize	Integer	Yes	Volume size of a worker node.
systemDiskConfig	Escaped string representation of JSON	Yes	Properties of the system storage. Includes the file system, source mount, and access point.
dataDisksConfig	Escaped string representation of JSON	Yes	Properties of the data storage. Includes the file system, source mount, and access point.
initScriptPath	String	Yes	Not used. An elastic runtime environment doesn't use initialization scripts.
masterNodeIAMRole	String	Yes	IAM role for the master node.
workerNodeIAMRole	String	-	Not used.
imageRegistryHost	String	-	Not used.
imageRegistryUser	String	-	Not used.
imageRegistryPassword	String	-	Not used.
dateDeployed	Date	-	Leave this field empty.
miscTags	Escaped string representation of JSON	Yes	Cloud ecosystem tags and runtime properties. Each tag category is required, but their values can be empty. For example: "miscTags": "{\"cloudEcosystemTags\":[],\"runtimeProperties\":[]}"

PUT response

If successful, returns the ClusterConfig object in the PUT request.

PUT example

To update a configuration, send a request like the following example:

POST <baseApiUrl>/public/core/v3/ClusterConfig/<config_ID>
Content-Type: application/json
Accept: application/json
INFA-SESSION-ID: <sessionId>
{
"id": "89Dnw937Al30sN40ia9Oat",
"orgId": "dx7DSOIGiiPh6XQoZKpAmC",
"infaManaged": false,
"clusterName": "test-cluster-102",
"description": "Description of the cluster",
"cloudPlatform": "AWS",
"haEnabled": false,
"region": "ap-south-1",
"subnets": [
"subnet-name1",
"subnet-name2"
],
"masterNodeInstanceType": "",
"maxWorkerNodes": 10,
"minWorkerNodes": 1,
"workerNodeIdleTimeout": 5,
"workerNodeInstanceType": "c4.2xlarge",
"workerNodeVolumeSize": 100,
"systemDiskConfig": "{\"id\": \"\", \"sourceMount\": \"\", \"accessPoint\": \"\"}",
"dataDisksConfig": "[{\"id\": \"\", \"sourceMount\": \"\", \"targetMount\": \"\", \"accessPoint\": \"\"}]",
"initScriptPath": "/path/to/script",
"masterNodeIAMRole": "masterRole",
"workerNodeIAMRole": "workerRole",
"imageRegistryHost": "registry.example.com",
"imageRegistryUser": null,
"imageRegistryPassword": "null",
"dateDeployed": null,
"miscTags": "{\"cloudEcosystemTags\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}],\"runtimeProperties\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}]}"
}

If successful, you receive a response like the following example:

{
"id": "89Dnw937Al30sN40ia9Oat",
"orgId": "dx7DSOIGiiPh6XQoZKpAmC",
"infaManaged": false,
"clusterName": "test-cluster-102",
"description": "Description of the cluster",
"cloudPlatform": "AWS",
"haEnabled": false,
"region": "ap-south-1",
"subnets": [
"subnet-name1",
"subnet-name2"
],
"masterNodeInstanceType": "",
"maxWorkerNodes": 10,
"minWorkerNodes": 1,
"workerNodeIdleTimeout": 5,
"workerNodeInstanceType": "c4.2xlarge",
"workerNodeVolumeSize": 100,
"systemDiskConfig": "{\"id\": \"\", \"sourceMount\": \"\", \"accessPoint\": \"\"}",
"dataDisksConfig": "[{\"id\": \"\", \"sourceMount\": \"\", \"targetMount\": \"\", \"accessPoint\": \"\"}]",
"initScriptPath": "/path/to/script",
"masterNodeIAMRole": "masterRole",
"workerNodeIAMRole": "workerRole",
"imageRegistryHost": "registry.example.com",
"imageRegistryUser": null,
"imageRegistryPassword": "null",
"dateDeployed": null,
"miscTags": "{\"cloudEcosystemTags\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}],\"runtimeProperties\":[{\"key\":\"k1\",\"val\":\"v1\"},{\"key\":\"k2\",\"val\":\"v2\"}]}"
}

Reading a runtime environment association by elastic runtime environment identifier

You can request details about the association between a cluster and the elastic runtime environment using the runtime environment identifier.

GET request

To get the association between the configuration and the runtime environment, use the following URI:

/public/core/v3/RuntimeEnvironment/<rte_id>/Cluster

Where <rte_id> is the runtime environment identifier.

GET response

If successful, returns the following information for the association:

Field	Type	Description
rteId	String	Runtime environment ID.
clusterId	String	Configuration ID.
namespace	String	Namespace used.
createdBy	String	Name of the user who created the association.

GET response example

To get the association between the configuration and runtime environment, use the following request:

GET <baseApiUrl>/public/core/v3/RuntimeEnvironment/<rte_id>/Cluster
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you might receive a response like the following example:

{
"rteId": "01B0IV2500000000035Y",
"clusterId": "5gic8zWc1G7fSDQVJRpUEh",
"namespace": "test-namespace-1",
"createdBy": "test-user-1"
}

Reading a runtime environment association by cluster identifier

You can request details about the association between a cluster and the elastic runtime environment using the configuration identifier.

GET request

To get the association between the configuration and the runtime environment, use the following URI:

/public/core/v3/RuntimeEnvironment/<cluster_id>/Cluster

Where <cluster_id> is the configuration identifier.

GET response

If successful, returns the following information for the association:

Field	Type	Description
rteId	String	Runtime environment ID.
clusterId	String	Configuration ID.
namespace	String	Namespace used.
createdBy	String	Name of the user who created the association.

GET response example

To get the association between the configuration and runtime environment, use the following request:

GET <baseApiUrl>/public/core/v3/RuntimeEnvironment/<cluster_id>/Cluster
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you might receive a response like the following example:

{
"rteId": "01B0IV2500000000035Y",
"clusterId": "5gic8zWc1G7fSDQVJRpUEh",
"namespace": "test-namespace-1",
"createdBy": "test-user-1"
}

Associating a configuration with a runtime environment

You can associate a cluster with a runtime environment.

POST request

To associate a configuration with a runtime environment, use the following URI:

/public/core/v3/RuntimeEnvironment/<rte_id>/Cluster/<cluster_id>

Where <rte_id> is the runtime identifier identifier and <cluster_id> is the configuration identifier.

Include the following information:

Field	Type	Required	Description
namespace	String	-	Namespace of the configuration.

POST response

If successful, returns the following information:

Field	Type	Description
rteId	String	Runtime environment ID.
clusterId	String	Configuration ID.
namespace	String	Namespace used.
createdBy	String	Name of the user who created the association.

POST response example

To associate a configuration and runtime environment, use the following request:

GET <baseApiUrl>/public/core/v3/RuntimeEnvironment/<rte_id>/Cluster/<cluster_id>
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you receive a response similar to the following example:

{
"rteId": "01B0IV2500000000035Y",
"clusterId": "5gic8zWc1G7fSDQVJRpUEh",
"namespace": "test-namespace-1",
"createdBy": "test-user-1"
}

Getting runtime environment image information

If you have Kubernetes DevOps engineers privileges, you can list the available images that you can download.

GET request

To list all available images, use the following URI:

/public/core/v3/ais/RuntimeApplicationImage?runtimeEnvironmentId=<rteId>

Include the following parameter:

Parameter	Type	Description
rteId	String	Runtime environment ID from which images are downloaded.

The following table lists the potential error codes for a request:

HTTP status code	Description
401	Unauthenticated or unauthorized.
403	Privilege get.k8s.repository.token is required for accessing this API.

GET response

If successful, a list of available images is returned.

GET response examples

To list available images for download, use the following request:

GET <baseApiUrl>/public/core/v3/RuntimeApplicationImage?runtimeEnvironmentId=<rteId>
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you might receive a "200 OK" response like the following example:

[
{
"appSpecName": "Data_Integration",
"appSpecVersion": "64.0",
"dependencies": "package-Administrator_R1.226",
"imageName": "Data_Integration",
"imageVersion": "64.0",
"imageRepositoryPath": "infacloud-k8s-agent-docker-dev.jfrog.io/3SLs6FMAlJ0lGGyI0pMK0g/rteId1/DataIntegration:64.0",
"rteGroupId": "rteId1",
"orgId": "3SLs6FMAlJ0lGGyI0pMK0g",
"endTime": "2022-10-31T07:06:59.000Z",
"helmChartPath": "helmChartPath"
},
{
"appSpecName": "Data_Integration",
"appSpecVersion": "64.1",
"dependencies": "package-Administrator_R1.226,
"imageName": "Data_Integration,
"imageVersion": "64.1",
"imageRepositoryPath": "infacloud-k8s-agent-docker-dev.jfrog.io/3SLs6FMAlJ0lGGyI0pMK0g/rteId1/DataIntegration:64.1",
"rteGroupId": "rteId1",
"orgId": "3SLs6FMAlJ0lGGyI0pMK0g",
"endTime": "2022-10-31T07:06:59.000Z",
"helmChartPath": "helmChartPath"
}
]

If you have insufficient privileges, you might receive a "403 Forbidden" response like the following example:

{
"error": {
"code": "AIS_007",
"message": "Privilege - view.k8s.agent.config required for accessing this API.",
"debugMessage": "Privilege - view.k8s.agent.config required for accessing this API.",
"requestId": "l2EpwkFoqkEjrEJURclPw2",
"details": null
}
}

Getting a new token

If you have Kubernetes DevOps engineers privileges, you can request a token that you can use to access and download images from the artifactory.

GET request

To get a new token, use the following URI:

/public/core/v3/containerimagetoken/create

The following table lists the potential error codes for a request:

HTTP status code	Description
401	Unauthenticated or unauthorized.
403	Insufficient privilege. The get.k8s.repository.token privilege is required to access this API.

GET response

If successful, returns the token ID and the token value.

GET response examples

To get a new token, use the following request:

GET <baseApiUrl>/public/core/v3/containerimagetoken/create
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you might receive a "200 OK" response like the following example:

{
"tokenId":"<token ID>",
"tokenValue":"<token value>"
}

If you have insufficient privileges, you might receive a "403 Forbidden" response like the following example:

If the token has been revoked, you might receive a "400 Bad Request" response like the following example:

{
"error": {
"code": "AIS_014",
"message": "Token with id:<token ID> already revoked.",
"debugMessage": "Token with id:<token ID> already revoked.",
"requestId": "iVdlwEoaFiZd3vb0LvLVmp",
"details": null
}
}

Revoking a token

If you have Kubernetes DevOps engineers privileges, you can revoke a token.

DELETE request

To revoke a token, use the following URI:

/public/core/v3/containerImageToken/revoke/<tokenId>

Include the following parameter:

Parameter	Type	Description
tokenId	String	ID of the token to be revoked.

The following table lists the potential error codes for a request:

HTTP status code	Description
400	Token with id:{tokenId} already revoked.
400	User:{0} is not authorized to revoke this token.
401	Unauthenticated or unauthorized.
403	Privilege get.k8s.repository.token is required for accessing this API.

DELETE response

If successful, the token is revoked.

DELETE response examples

To revoke a token, use the following request:

DELETE <baseApiUrl>/public/core/v3/containerImageToken/revoke/<tokenId>
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you receive a "200 OK" response.

If you have insufficient privileges, you might receive a "403 Forbidden" response like the following example:

If the token has already been revoked, you might receive a "400 Bad Request" response like the following example:

If you are not authorized to revoke the token, you might receive a "400 Bad Request" response like the following example:

{
"error": {
"code": "AIS_013",
"message": "User:k8s is not authorized to revoke this token :<token ID>.",
"debugMessage": "User:k8s is not authorized to revoke this token :<token ID>.",
"requestId": "iLhZ6l6EF6Ddb3jICTGxoj",
"details": null
}
}

Getting all tokens for an organization

If you have Kubernetes DevOps engineers privileges, you can list all the tokens for the organization.

GET request

To list all tokens for the organization, use the following URI:

/public/core/v3/containerImageToken

Include the following parameter:

Parameter	Type	Description
orgId	String	Organization ID to see the generated tokens.

The following table lists the potential error codes for a request:

HTTP status code	Description
401	Unauthenticated or unauthorized.
403	Privilege get.k8s.repository.token is required for accessing this API.

GET response

If successful, a list of all the tokens for the organization is returned.

GET response examples

To list available images for download, use the following request:

GET <baseApiUrl>/public/core/v3/containerImageToken
Content-type: application/json
Accept: application/json
INFA-SESSION-ID: <SessionId>

If successful, you might receive a "200 OK" response like the following example:

[
{
"orgId": "52ZSTB0IDK6dXxaEQLUaQu",
"userId": "admin",
"tokenId": "<token ID>",
"expirationTime": "2022-10-31T07:06:59.000Z"
},
{
"orgId": "52ZSTB0IDK6dXxaEQLUaQu",
"userId": "admin",
"tokenId": "<token ID>",
"expirationTime": "2022-10-31T07:06:59.000Z"
}
]

If you have insufficient privileges, you might receive a "403 Forbidden" response like the following example: