# Forbidden requests (1009) on Square API Requests **URL:** \ **Category:** Questions\ **Tags:** payments-api\ **Created:** [June 6, 2023, 4:29am UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693 "2023-06-06T04:29:24Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![dougvan](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dougvan](https://developer.squareup.com/forums/u/dougvan)\ **Post date:** [June 6, 2023, 4:29am UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/1 "2023-06-06T04:29:24Z")
We just started receiving โ€œ[HTTP/1.1 403 Forbidden] error code: 1009โ€ on all our Square API requests from our website ([midwestvolleyball.com](http://midwestvolleyball.com)). This started either late Sunday or early Monday. We also make Square API requests from our internal accounting system and they are working fine. I believe the requests from both systems are identical. The location for requests: RFX4FGQR6D2C5 Is there anything on your end to identify the problem? Thanks for your help! ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 6, 2023, 3:36pm UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/2 "2023-06-06T15:36:20Z")
Whatโ€™s the IP address of the traffic thatโ€™s being blocked? ๐Ÿ™‚ ---
**Author:** ![dougvan](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dougvan](https://developer.squareup.com/forums/u/dougvan)\ **Post date:** [June 6, 2023, 4:25pm UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/3 "2023-06-06T16:25:07Z")
IP is 74.208.234.28 Thanks for your help! Doug ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 6, 2023, 4:53pm UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/4 "2023-06-06T16:53:23Z")
What are the endpoints your calling? ๐Ÿ™‚ ---
**Author:** ![dougvan](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dougvan](https://developer.squareup.com/forums/u/dougvan)\ **Post date:** [June 6, 2023, 5:09pm UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/5 "2023-06-06T17:09:07Z")
The simplest one is /v2/locations. A request to list our locations is getting the Forbidden response. Itโ€™s something that has been running well for years and stopped working in the last day or two. I have disabled our website until we get it working again. ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 6, 2023, 10:11pm UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/6 "2023-06-06T22:11:50Z")
Okay, great. The team is looking into this. ๐Ÿ™‚ ---
**Author:** ![dougvan](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dougvan](https://developer.squareup.com/forums/u/dougvan)\ **Post date:** [June 7, 2023, 5:40am UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/7 "2023-06-07T05:40:32Z")
Note sure if this is helpful, but here is the response headers when I try to request a list of locations from the v2/locations endpoint: ```auto Caught exception! Response body: string(16) "error code: 1009" Response headers: array(12) { [0]=> string(22) "HTTP/1.1 403 Forbidden" ["Date"]=> string(29) "Wed, 07 Jun 2023 05:34:50 GMT" ["Content-Type"]=> string(25) "text/plain; charset=UTF-8" ["Content-Length"]=> string(2) "16" ["Connection"]=> string(10) "keep-alive" ["X-Frame-Options"]=> string(10) "SAMEORIGIN" ["Referrer-Policy"]=> string(11) "same-origin" ["Cache-Control"]=> string(82) "private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0" ["Expires"]=> string(29) "Thu, 01 Jan 1970 00:00:01 GMT" ["Set-Cookie"]=> string(261) "__cf_bm=s9PQLuRP9zSCKZVghX1j06KR19TLrlG3MIvAjsSjWz8-1686116090-0-AYUdjqhssmFFkdoGLCFjXItu7VtcqPGhylDwf7pX4yTI7dpII7gKUogkJsbJTUk9kRdt4jWWc9dIlYWFMFkm1wM=; path=/; expires=Wed, 07-Jun-23 06:04:50 GMT; domain=.connect.squareup.com; HttpOnly; Secure; SameSite=None" ["Server"]=> string(10) "cloudflare" ["CF-RAY"]=> string(20) "7d36873d6f0b2b1b-MCI" } ``` ---
**Author:** ![dougvan](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dougvan](https://developer.squareup.com/forums/u/dougvan)\ **Post date:** [June 7, 2023, 3:28pm UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/8 "2023-06-07T15:28:57Z")
Our Square API requests are working again! Although I do not know why they started working. I tried a few things yesterday, like disabling the firewall and rebooting our server, but none of it made a difference. I did see our server is listed on the UCEPROTECTL3 blacklist, which seems to happen from time to time. We are still listed on it as of this morning, but our API requests are working now! Brian - thanks for working on this. It would be helpful to know if your team was able to track down a problem that was causing our API requests to fail. Are we missing something from our requests, such as versioning info, that caused the problem? ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 7, 2023, 6:03pm UTC](https://developer.squareup.com/forums/t/forbidden-requests-1009-on-square-api-requests/9693/9 "2023-06-07T18:03:51Z")
There was an issue on our end and the team deployed a fix to allow the traffic. Thanks for bringing this to our attention. ๐Ÿ™‚