diff --git a/CHANGELOG.md b/CHANGELOG.md
index c4d6105..71fc8db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.5.4
+
+* add 403 as a valid response code for get_service call
+
 ## 2.5.3
 
 * upgrade to python3.10
diff --git a/confidant_client/__init__.py b/confidant_client/__init__.py
index d73f90a..469408a 100644
--- a/confidant_client/__init__.py
+++ b/confidant_client/__init__.py
@@ -312,7 +312,7 @@ def get_service(self, service, decrypt_blind=False, metadata_only=False):
             response = self._execute_request(
                 'get',
                 '{0}/v1/services/{1}'.format(self.config['url'], service),
-                expected_return_codes=[200, 404],
+                expected_return_codes=[200, 403, 404],
                 params={'metadata_only': metadata_only},
             )
         except RequestExecutionError:
@@ -322,6 +322,10 @@ def get_service(self, service, decrypt_blind=False, metadata_only=False):
             logging.debug('Service not found in confidant.')
             ret['result'] = True
             return ret
+        if response.status_code == 403:
+            logging.debug('Access denied to service in confidant.')
+            ret = {**ret, **response.json()}
+            return ret
         try:
             data = response.json()
             if decrypt_blind:
diff --git a/setup.py b/setup.py
index 19702cb..289c054 100644
--- a/setup.py
+++ b/setup.py
@@ -18,7 +18,7 @@
 
 setup(
     name="confidant-client",
-    version="2.5.3",
+    version="2.5.4",
     packages=find_packages(exclude=["test*"]),
     install_requires=[
         # Boto3 is the Amazon Web Services (AWS) Software Development Kit (SDK)