403 Forbidden error when creating incidents via REST API when setting assignment_group

[KaustubhM959896]

Hello,

I'm getting a 403 Forbidden error when creating incidents via REST API when setting assignment_group:

**Error:**
"Operation against file 'incident' was aborted by Business Rule 'Abort changes on group^11aba63683feb21052349b55eeaad31b'"

**Request Payload:**
{
"short_description": "Test incident",
"caller_id": "[valid_user_sys_id]",
"assignment_group": "[valid_group_sys_id]",
"urgency": "3",
"impact": "3"
}

**What I've Verified:**
- Group sys_id is valid and group is Active
- Group has members
- Only setting assignment_group (NOT assigned_to)

**Questions:**
1. Where can I find this Business Rule? (sys_id: 11aba63683feb21052349b55eeaad31b - not showing in Business Rules list)
2. What does it typically validate?
3. What am I missing?

The same API call works fine without assignment_group. Any guidance on troubleshooting this would be appreciated!

Thanks in advance!

[Weird]

The error tells you which rule prevented it, but "Abort changes on group^11aba63683feb21052349b55eeaad31b'" sounds like weird. Did someone name a BR like that? Try looking for a BR where name is "Abort changes on group^11aba63683feb21052349b55eeaad31b".
The sys_id is probably a sys_id for a group.

For question 2 the BR is most likely custom so I can't say what it does, but I believe it is designed to prevent updates to a group that is supposed to be updated by certain people or integration etc.

3. You'll have to compare the group's sys_id to the ones in the BR if you can find it. There's probably more than 1 in the BR's condition or script.

[Ankur Bawiskar]

@KaustubhM959896 

any customization is stopping the update?

Any data policy is stopping?

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Mark Manders]

Check for a business rule on incident or task that prevents from updating the assignment group. It could also be that there is an 'assigned to' on the incident that is not member of the group, preventing the group to change because of dependencies. But that's all guessing.