FloQast incident
403 Permissions Error Response on sending API Requests to Specific Endpoints
Resolved after 3 hours 52 minutes, affecting FloQast API, on April 2, 2026.
**Summary:** Clients experienced authorization errors \(403s\) when attempting to push data through FloQast's external API integration pipeline. **Root Cause:** As part of ongoing security infrastructure improvements, FloQast migrated services to a more robust web application firewall \(WAF\) configuration. In pre-production environments, a supplemental ruleset had been in place that, by design, took precedence over certain standard security rules — effectively masking how those rules would behave in production. When the migration to the stricter production security configuration occurred, legitimate integration traffic was inadvertently caught and blocked. **Immediate Resolution:** Engineering teams performed a full rollback of the affected deployments, restoring integration functionality for impacted customers. Once stable, the team began a careful analysis of the specific security rules to confirm that the appropriate level of restrictions was being adhered to. **Follow-up Actions:** The team is taking a deliberate approach to reintroducing the production security ruleset in monitoring mode before enforcing blocks, allowing for validation against known traffic patterns.
Affected components
Update timeline
- investigating Apr 02, 2026, 01:54 PM UTC
We are receiving reports of 403s when interacting with specific API endpoints such as our Trial Balance or Chart of Accounts endpoints
- monitoring Apr 02, 2026, 03:47 PM UTC
A fix has been implemented and we are monitoring the results.
- resolved Apr 02, 2026, 05:46 PM UTC
Apr 2, 10:46 PDT Resolved - The fix for this has been deployed, and the incident has been resolved. Apr 2, 08:47 PDT Monitoring - A fix has been implemented and we are monitoring the results. Apr 2, 06:54 PDT Investigating - We are receiving reports of 403s when interacting with specific API endpoints such as our Trial Balance or Chart of Accounts endpoints
- resolved Apr 02, 2026, 05:46 PM UTC
The fix for this has been deployed, and the incident has been resolved.
- postmortem Apr 06, 2026, 06:16 PM UTC
**Summary:** Clients experienced authorization errors \(403s\) when attempting to push data through FloQast's external API integration pipeline. **Root Cause:** As part of ongoing security infrastructure improvements, FloQast migrated services to a more robust web application firewall \(WAF\) configuration. In pre-production environments, a supplemental ruleset had been in place that, by design, took precedence over certain standard security rules — effectively masking how those rules would behave in production. When the migration to the stricter production security configuration occurred, legitimate integration traffic was inadvertently caught and blocked. **Immediate Resolution:** Engineering teams performed a full rollback of the affected deployments, restoring integration functionality for impacted customers. Once stable, the team began a careful analysis of the specific security rules to confirm that the appropriate level of restrictions was being adhered to. **Follow-up Actions:** The team is taking a deliberate approach to reintroducing the production security ruleset in monitoring mode before enforcing blocks, allowing for validation against known traffic patterns.
Your product runs on more than FloQast
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services