Unable to export Apps "code" : "403-forbidden"

Available Languages

Updated:September 29, 2026

Document ID:SPLK048393

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Unable to export apps via App control service(ACS), resulting in error "403 forbidden" indicating issues with permission to export the app vis ACS. This issue is due the password.conf content being overwritten as a result of the upgrade and app exports.

Investigation

1. As the error observed "403 forbidden" points to an issue with permission to access the object or the permission to carry out the action in question, validate if the user trying to export the app has "export_apps" capability. By default sc_admin does not have this capability

Manage ACS API access with capabilities

2. As content stored in password.conf is used to authenticate the user to run the export request, validate if password.conf has valid content.

3. With every upgrade and also with every app export, the password.conf is being over written at disk level rather than app file. Because of this the export operation fails due to permission validation of the user which is done through password.conf file.

4. This issue can happen with any app that has content stored in apps password.conf file.

Resolution

The issue is a registered known issue in Splunk Cloud and is fixed in Splunk Cloud version 9.2.2406.110. Version below the fixed version can potentially hit the known issue.