From 67ea3b9ce8321499a81961cdc1faddbf2cbacb2a Mon Sep 17 00:00:00 2001
From: Travis Ralston <travpc@gmail.com>
Date: Wed, 12 Jun 2019 15:41:10 -0600
Subject: [PATCH] Add 403 error to IS unbind

Fixes https://github.com/matrix-org/matrix-doc/issues/2117
---
 api/identity/associations.yaml                      | 13 +++++++++++++
 .../newsfragments/2126.clarification                |  1 +
 2 files changed, 14 insertions(+)
 create mode 100644 changelogs/identity_service/newsfragments/2126.clarification

diff --git a/api/identity/associations.yaml b/api/identity/associations.yaml
index f44fe3cc..8ff4a9ed 100644
--- a/api/identity/associations.yaml
+++ b/api/identity/associations.yaml
@@ -279,6 +279,19 @@ paths:
             If the response body is not a JSON Matrix error, the identity server
             does not support unbinds. If a JSON Matrix error is in the response
             body, the requesting party should respect the error.
+        403:
+          description: |-
+            The credentials supplied to authenticate the request were invalid.
+            This may also be returned if the identity server does not support
+            the chosen authentication method (such as blocking homeservers from
+            unbinding identifiers).
+          examples:
+            application/json: {
+              "errcode": "M_FORBIDDEN",
+              "error": "Invalid homeserver signature"
+            }
+          schema:
+            $ref: "../client-server/definitions/errors/error.yaml"
         501:
           description: |-
             If the response body is not a JSON Matrix error, the identity server
diff --git a/changelogs/identity_service/newsfragments/2126.clarification b/changelogs/identity_service/newsfragments/2126.clarification
new file mode 100644
index 00000000..1475b4b4
--- /dev/null
+++ b/changelogs/identity_service/newsfragments/2126.clarification
@@ -0,0 +1 @@
+Clarify that identity servers can return 403 for unbind requests.