If you receive a 403 Forbidden when you have specified a correct Control username and password, then it is possible the username you specified may have not have a Security Role defined for the API.
Each username for Control must be mapped to a corresponding UserNameUserSecurityRole record in order for the API to determine which security role should be utilized for the API. If your username is not mapped then the mapping will fail to lookup the security role and you will receive a HTTP 403 Forbidden error.
SELECT ID, LoginName FROM Username
SELECT * FROM UserNameUserSecurityRole
INSERT INTO UserNameUserSecurityRole VALUES ([UserName ID],1)
INSERT INTO UserNameUserSecurityRole VALUES (1001,1)
Contributor: Brandon R., Cyrious
Date: 8/8/2013
Version: Control 5.1