From 079e30f496a54b23bf7e1024420b22cd19e976f1 Mon Sep 17 00:00:00 2001
From: Mike Degatano <michael.degatano@gmail.com>
Date: Mon, 4 Mar 2024 10:27:16 -0500
Subject: [PATCH] APIForbidden should result in 403 status

---
 supervisor/api/utils.py     | 9 ++++++---
 supervisor/exceptions.py    | 4 ++++
 tests/api/test_discovery.py | 2 +-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/supervisor/api/utils.py b/supervisor/api/utils.py
index 8c8db2259f7..deae62ba1e8 100644
--- a/supervisor/api/utils.py
+++ b/supervisor/api/utils.py
@@ -129,12 +129,15 @@ def api_return_error(
         JSON_RESULT: RESULT_ERROR,
         JSON_MESSAGE: message or "Unknown error, see supervisor",
     }
-    if isinstance(error, APIError) and error.job_id:
-        result[JSON_JOB_ID] = error.job_id
+    status = 400
+    if isinstance(error, APIError):
+        status = error.status
+        if error.job_id:
+            result[JSON_JOB_ID] = error.job_id
 
     return web.json_response(
         result,
-        status=400,
+        status=status,
         dumps=json_dumps,
     )
 
diff --git a/supervisor/exceptions.py b/supervisor/exceptions.py
index abbe603a327..8eece236f47 100644
--- a/supervisor/exceptions.py
+++ b/supervisor/exceptions.py
@@ -308,6 +308,8 @@ class HostLogError(HostError):
 class APIError(HassioError, RuntimeError):
     """API errors."""
 
+    status = 400
+
     def __init__(
         self,
         message: str | None = None,
@@ -322,6 +324,8 @@ def __init__(
 class APIForbidden(APIError):
     """API forbidden error."""
 
+    status = 403
+
 
 class APIAddonNotInstalled(APIError):
     """Not installed addon requested at addons API."""
diff --git a/tests/api/test_discovery.py b/tests/api/test_discovery.py
index 304e68f3133..6dc5f6892f4 100644
--- a/tests/api/test_discovery.py
+++ b/tests/api/test_discovery.py
@@ -25,7 +25,7 @@ async def test_api_discovery_forbidden(
     with caplog.at_level(logging.ERROR):
         resp = await api_client.post("/discovery", json={"service": "mqtt"})
 
-    assert resp.status == 400
+    assert resp.status == 403
     result = await resp.json()
     assert result["result"] == "error"
     assert (