Budibase/budibase · error · HTTPError

Forbidden

Error message

Forbidden

What it means

Even in preview mode, only workspace admins or builders may stream agent chats. The SDK check users.isAdminOrBuilder(ctx.user, workspaceId) gates the endpoint; regular app users receive HTTP 403 'Forbidden'.

Source

Thrown at packages/server/src/api/controllers/ai/chatConversations.ts:391

  const chat = ctx.request.body
  const userId = getGlobalUserId(ctx)
  applyChatStreamPathParams(chat, ctx.params)

  const workspaceId = context.getWorkspaceId()
  if (!workspaceId) {
    throw new HTTPError("Workspace context is required", 400)
  }
  const isBuilderOrAdmin = usersSdk.users.isAdminOrBuilder(
    ctx.user,
    workspaceId
  )

  if (chat.isPreview !== true) {
    throw new HTTPError("Preview mode is required", 400)
  }

  if (!isBuilderOrAdmin) {
    throw new HTTPError("Forbidden", 403)
  }

  if (!isDevWorkspaceID(workspaceId)) {
    throw new HTTPError("Preview mode requires a development workspace", 400)
  }

  let user = ctx.user
  if (chat.previewRoleId) {
    const previewRole = await roles.getRole(chat.previewRoleId)
    if (!previewRole?._id) {
      throw new HTTPError("Preview role not found", 400)
    }
    user = {
      ...ctx.user,
      roleId: previewRole._id,
    }
  }

View on GitHub (pinned to a81a902e9a)

Solutions

1. Log in as a builder or workspace admin to use preview chat
2. Grant the user builder/admin permissions in the workspace if legitimately needed
3. Use the non-preview (production) chat path for end users, if available

const canPreview = ["ADMIN", "BUILDER"].includes(user.roleId)
if (!canPreview) throw new Error("Builder or admin role required for preview chat")

try {
  await streamChat(body)
} catch (e) {
  if (e.status === 403) {
    // show a 'builder/admin only' message instead of retrying
  }
}

When it happens

Trigger: An authenticated app-end user (non-builder, non-admin role) POSTs to the preview chat stream endpoint with isPreview: true.

Common situations: Testing agent chat as a normal app user; role downgrades after re-login; previewRoleId spoofing attempts by non-privileged users.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied to object store bucket.${err}
• Knowledge source downloads are disabled for this operation
• Invalid webhook schema token
• CouchDB password not set
• Please visit "Account" to delete this user

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/bcbd4b189c67a7dd. Report an issue: GitHub.