Permission denied

permission_deniedHTTP 403Retrying the same request will not help

The server knows who is calling, and they are not allowed to do this.

Why it happens

• An @allow policy in the schema refuses this caller, for the operation or for a field the shape selects.
• A capability token does not name this operation.
• A browser sent a command from an origin the server does not allow, or the Host header is not accepted.

What to do

• Check the policy on the operation or field in the schema; the explorer lists which policies guard each operation.
• Leave out fields the caller may not read, or mark them @partial so they come back as null instead of failing the operation.
• For a web app on another origin, add that origin to the server's allowedOrigins.

What it looks like

Inside a batch, the operation's frame carries it:

{
  "id": 1,
  "error": {
    "code": "permission_denied",
    "message": "Book.costPrice: not allowed for this viewer"
  },
  "fin": true
}

When the whole request is refused over HTTP, the answer is a problem document:

{
  "type": "https://eddyboutros.github.io/rayfold/errors/permission_denied",
  "title": "permission denied",
  "status": 403,
  "detail": "Book.costPrice: not allowed for this viewer",
  "code": "permission_denied"
}

See also all error types and the errors chapter of the specification.