---
title: "Nexter Fields REST API Returns 403 Forbidden"
url: https://nexterwp.com/docs/nexter-fields-rest-api-403/
date: 2026-09-14
modified: 2026-09-14
lang: en
author: "Aditya Sharma"
description: "A request to a Content Fields admin route comes back 403 Forbidden. That is the API behaving correctly — those routes are administrator-only. What It Does The routes that create..."
image: https://nexterwp.com/wp-content/uploads/2026/09/nexter-fields-rest-api-403-1024x519.jpg
word_count: 270
---

# Nexter Fields REST API Returns 403 Forbidden

A request to a Content Fields admin route comes back `403 Forbidden`. That is the API behaving correctly — those routes are administrator-only.

## What It Does

The routes that create and edit field groups, post types and taxonomies all require the `manage_options` capability. Reading field *values* is a different surface and uses the ordinary WordPress REST API.

## Before You Start

- You are calling a `content-types/v1` route.- You know which user the request authenticates as.

## Diagnose the 403

- **Check the user.** Every Content Fields admin route requires `manage_options`. An editor or author gets 403 by design.

![Content Fields in the Nexter menu](https://nexterwp.com/wp-content/uploads/2026/09/nxt-fields-s-menu-content-fields.webp)

- **Check the request is authenticated at all.** An unauthenticated request gets `401`, not 403 — so a 403 means you are logged in as someone without the capability.

- **Check you want that surface.** To read field values, query the post through `/wp/v2/` and read its `meta`. That does not need administrator rights.

- **Check the nonce or application password** if you are calling from a browser or an external tool.

## Limitations

- This is not configurable. The admin routes are gated on `manage_options` deliberately, because they change the site’s data model.- A `400` response with a missing-parameter code is not an authorisation problem — WordPress validates required parameters before it runs the permission check, so the 400 comes first.

## Troubleshooting

### My editor account gets 403

Correct behaviour. Field group management is administrator-only. Use an administrator account, or read values through `/wp/v2/` instead.

### I get 401, not 403

The request is not authenticated. Add an application password or a valid nonce.

## Related Docs

- [Content Fields and the WordPress REST API](https://nexterwp.com/docs/nexter-fields-rest-api/)- [Why is my custom field empty?](https://nexterwp.com/docs/custom-field-empty-not-showing/)- [Create a field group in WordPress](https://nexterwp.com/docs/create-a-field-group-wordpress/)