Permission denied

permission_deniedHTTP 403Retrying the same request will not help

The server knows who is calling, and they are not allowed to do this.

Why it happens

• An @allow policy in the schema refuses this caller, for the operation or for a field the shape selects.
• A capability token does not name this operation.
• A browser sent a command from an origin the server does not allow, or the Host header is not accepted.

What to do

• Check the policy on the operation or field in the schema; the explorer lists which policies guard each operation.
• Leave out fields the caller may not read, or mark them @partial so they come back as null instead of failing the operation.
• For a web app on another origin, add that origin to the server's allowedOrigins.

What it looks like

Inside a batch, the operation's frame carries it:

{
  "id": 1,
  "error": {
    "code": "permission_denied",
    "message": "Not allowed to access Book.costPrice"
  },
  "fin": true
}

retryable appears only where it differs from the code's default, which is the one at the top of this page.

When the whole request is refused over HTTP, the answer is a problem document:

{
  "type": "https://eddyboutros.github.io/rayfold/errors/permission_denied",
  "title": "permission denied",
  "status": 403,
  "detail": "Not allowed to access Book.costPrice",
  "code": "permission_denied"
}

See also all error types and the errors chapter of the specification.