DocumentationExperience Cloud KCS

Resolve 403 errors when creating EDS sites or accessing Log Viewer

Last update: October 2, 2026

This article explains how to resolve HTTP 403 Forbidden errors encountered during site creation via the admin API and when accessing logs through the Log Viewer tool in Adobe Edge Delivery Services. These errors are typically caused by insufficient user permissions or missing authentication requirements.

Description description

Environment

  • Adobe Experience Manager as a Cloud Service with Edge Delivery Services
  • Admin API site-creation and site-configuration operations
  • Site Admin and Log Viewer tools at tools.aem.live

Issue/Symptoms

  • When you create an EDS site through an organization-scoped Admin API operation, you receive 403 Forbidden even though your request is authenticated and you have Site Admin access.
  • When you open Log Viewer without the required log permission, the request returns 403 Forbidden.
  • The EDS Site Admin console and Log Viewer tools display a prompt requiring the AEM Sidekick browser extension for authentication. Without the extension, users cannot sign in or access these tools.

Cause

Authentication alone doesn’t authorize every Admin API operation. Organization-scoped site creation requires the corresponding organization-level permission; Site Admin access to an existing site doesn’t automatically grant that permission. Log Viewer access is a separate permission check: the role must include log:read, and the tools.aem.live browser interface uses Sidekick authentication.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Verify that users who need to create sites through the Admin API or access logs are assigned the Org Admin role for the relevant Edge Delivery Services organization. The Site Admin role alone doesn’t provide the required permissions.

  2. Assign the Org Admin role to the affected users. If you don’t have permission to manage roles or need assistance, contact your organization’s administrator or Adobe Support.

  3. When using the Admin API:

    • Use the endpoint format https://admin.hlx.page/config/<your-organization-name>/sites/<site>.json.
    • Replace <your-organization-name> with your organization name in lowercase.
    • Authenticate using an account that has the Org Admin role.

  4. To access the Log Viewer tool, open https://tools.aem.live/tools/log-viewer/index.html, sign in with an Org Admin account, and ensure that the AEM Sidekick browser extension is installed and enabled.

  5. If your organization doesn’t allow browser extensions, use the Admin API for administrative tasks. There is currently no supported method to access the Site Admin console or Log Viewer tool without the AEM Sidekick extension.

  6. If permission or access issues persist after assigning the Org Admin role, contact Adobe Support through the Adobe Admin Console or your standard support channel.

  7. After updating permissions, verify that you can create sites through the Admin API and access logs in the Log Viewer tool without receiving 403 errors.

recommendation-more-help
experience-cloud-kcs-help-kbarticles