A field that appears in your API schema but is not explicitly marked writable produces a 403 Forbidden on write, not a validation error. The response says nothing about which field caused it.
The cause
json-api-server treats writability as opt-in. Declaring a field makes it readable; it does not make it settable. A create or update that includes it is rejected as a permissions failure.
The fix
Mark the field writable explicitly, and gate it with the same check your policy uses:
Schema\Str::make('myField')
->writable(fn($model, $context) => $context->getActor()->can('edit', $model)),
Diagnosing it
Because the error is a bare 403, it looks like an authentication or policy problem and sends you to the wrong place. If the actor clearly has permission and you still get 403 on write, suspect an unwritable field before you suspect the policy.
Recommended Comments