I have already set up the Remote site settings. The problem is, I am able to get a response when I hit the api through postman/bruno but when I am making an apex callout I get 403 error.
Pasting the code below:
HttpRequest req = new HttpRequest();
req.setEndpoint('https://fakestoreapi.com/carts');
req.setMethod('GET');
Http http = new Http();
try {
HttpResponse res = http.send(req);
if (res.getStatusCode() == 200) {
String responseBody = res.getBody();
System.debug(responseBody);
} else {
String errorMessage = 'Error: ' + res.getStatusCode() + ' - ' + res.getStatus();
}
} catch (Exception e) {
System.debug('Exception occurred: ' + e.getMessage());
}
#Integration
Hi Shreya, good news, your Remote Site Settings are fine. A 403 is the remote server rejecting the request, which means the callout already left Salesforce successfully. A missing Remote Site Setting throws a different System.CalloutException about an unauthorized endpoint, not an HTTP 403.
The real cause: fakestoreapi sits behind Cloudflare, and Cloudflare blocks requests that arrive with no User-Agent header. Postman and Bruno add a User-Agent for you automatically, but Apex HttpRequest sends none, so Cloudflare treats it as a bot and returns 403.
Fix, add a couple of headers before you send:
req.setHeader('User-Agent', 'PostmanRuntime/7.43.0');
req.setHeader('Accept', 'application/json');
Re-run and you should get a 200. It is header-based, not an endpoint or auth problem, which is exactly why it works in Postman but not the raw callout.
If this helps, please mark it as the Best Answer so it helps the next person, thanks 🙂
