It's very simple: the ${B} is supposed to be replaced with a string variable from the variable called B. The forbidden error just means you are not allowed to access that specific resource. If there are specific authentication and authorisation requirements, you are supposed to follow them.