Extend Custom Object PATCH Returns 403 Forbidden When the Body Carries Escaped HTML
The error 403 Forbidden
PATCH https://api.workday.com/apps/[appID]/v1/[CustomObjectAlias]/[ObjectWID]
What does "403 Forbidden (Extend Custom Object PATCH Returns 403 Forbidden When the Body Carries Escaped HTML)" mean in Workday Extend?
A PATCH to an Extend custom object comes back 403 Forbidden when the body carries a long block of escaped HTML, even though the same field updates fine with short plain text. The rejection comes from how the API client serialised the body, not from the user's security.
Quick fix
Send the request body as raw text with an explicit application/json Content-Type header, instead of letting the API client's JSON body mode re-encode the escaped HTML.
Permanent fix
Build any request body containing markup programmatically and serialise it with a real JSON library, rather than pasting escaped HTML into an API client's JSON editor where the client controls the encoding.
Troubleshooting
- Retry the same PATCH with a short plain text value in the same field. If that succeeds, the security configuration is fine and the payload is what is being rejected.
- Rule out length as the cause by sending a long block of plain text. If that also succeeds, the problem is the markup, not the size.
- Check the body type your client is sending. A body typed as JSON in the client UI can re-encode the escaped quotes inside the HTML and corrupt the document before it ever leaves the client.
- Switch the body to raw text and set the Content-Type header to application/json yourself, so the client sends exactly the bytes you wrote.
- Validate the JSON in a separate parser before sending, since one unescaped quote inside the HTML breaks the whole document.
- If it still fails, shorten the HTML progressively to find whether a specific character rather than the block as a whole triggers the rejection.
Was this helpful?