title: Cypress API Call Forbidden 403 Error ( "x-frame-options": "SAMEORIGIN, DENY" )
body: <p><strong>Issue :</strong></p>
  
  <ul>
  <li><p>I successfully Login and make a Post Call and receive for following
  error after making a cy.request( )POST API call :</p></li>
  <li><p>I was able to make cy.request( ) get API calls which retured 200 , so API call error seems specific to the above cy.request( ) POST API call </p></li>
  </ul>
  
  <p><strong>Error:</strong></p>
  
  <p>The response we got was:</p>
  
  <p>Status: 403 - Forbidden
  Headers: {
    "date": "Thu, 19 Dec 2019 16:10:19 GMT",
    "server": "Apache",
    "x-frame-options": "SAMEORIGIN, DENY",</p>
  
  <p><strong>Full Error</strong></p>
  
  <p>CypressError: cy.request() failed on:</p>
  
  <p><a href="https://uat1.dns2.merchantportal.eu/MerchantApiWeb/rest/secure/user/financial/preauthorisation" rel="nofollow noreferrer">https://uat1.dns2.merchantportal.eu/MerchantApiWeb/rest/secure/user/financial/preauthorisation</a></p>
  
  <p>The response we received from your web server was:</p>
  
  <blockquote>
    <p>403: Forbidden</p>
  </blockquote>
  
  <p>This was considered a failure because the status code was not '2xx' or '3xx'.</p>
  
  <p>If you do not want status codes to cause failures pass the option: 'failOnStatusCode: false'</p>
  
  <hr>
  
  <p><strong>The request we sent was:</strong></p>
  
  <p>Method: POST
  URL: <a href="https://uat1.dns2.merchantportal.eu/MerchantApiWeb/rest/secure/user/financial/preauthorisation" rel="nofollow noreferrer">https://uat1.dns2.merchantportal.eu/MerchantApiWeb/rest/secure/user/financial/preauthorisation</a>
  Headers: {
    "Connection": "keep-alive",
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36",
    "accept": "<em>/</em>",
    "Cookie": "NSC_JOfmamujd2zndlkdwlzogneusels0bQ=ffffffff09405a8245525d5f4f58455e445a4a42378b; ROUTEID=.1; JSESSIONID=mu_x-VvVK3_rycxkJ9eef9w7lUPzw-SFLqiyXZnd.r5cvap1013.1dc.com.MP.WEB",
    "accept-encoding": "gzip, deflate",
    "content-type": "application/json",
    "content-length": 101
  }
  Body: {"fromDate":"2019-12-19","toDate":"2019-12-19","pageNumber":1,"sortBy":"preAuthDate","sortOrder":"D"}</p>
  
  <hr>
  
  <p><strong>The response we got was:</strong></p>
  
  <p>Status: 403 - Forbidden
  Headers: {
    "date": "Thu, 19 Dec 2019 16:10:19 GMT",
    "server": "Apache",
    "x-frame-options": "SAMEORIGIN, DENY",
    "strict-transport-security": "max-age=15552000; includeSubdomains; preload, max-age=31536000 ; includeSubDomains",
    "expires": "0",
    "cache-control": "no-cache, no-store, max-age=3600, must-revalidate",
    "x-xss-protection": "1; mode=block",
    "pragma": "no-cache",
    "x-content-type-options": "nosniff",
    "content-type": "application/json;charset=ISO-8859-1",
    "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' <a href="https://cdnjs.cloudflare.com" rel="nofollow noreferrer">https://cdnjs.cloudflare.com</a> https://*.tiqcdn.com <a href="https://www.googletagmanager.com" rel="nofollow noreferrer">https://www.googletagmanager.com</a> <a href="https://www.google-analytics.com" rel="nofollow noreferrer">https://www.google-analytics.com</a>; connect-src 'self' <a href="https://www.google-analytics.com/" rel="nofollow noreferrer">https://www.google-analytics.com/</a>; img-src 'self' data: <a href="https://www.google-analytics.com" rel="nofollow noreferrer">https://www.google-analytics.com</a> https:; style-src 'self' 'unsafe-inline' blob:; font-src 'self' blob:; frame-src 'self' data: *; frame-ancestors 'self'; media-src *;",
    "x-powered-by": "",
    "keep-alive": "timeout=10",
    "connection": "Keep-Alive",
    "transfer-encoding": "chunked"
  }
  Body: {
    "code": "MPERR08",
    "message": "You are not privileged to request this resource.",
    "access-denied": true,
    "cause": "AUTHORIZATION_FAILURE"
  }</p>
  
  <p><a href="https://i.stack.imgur.com/huT40.png" rel="nofollow noreferrer">Error I Recieved - Click to see</a></p>