authz_forbidden

authz_forbidden

Error message

only viewers/editors/admins can access this resource

What it means

Authorization middleware rejects the request when the underlying RBAC check fails and the error is authz-forbidden for a viewer/editor/admin-level resource. Only users with at least viewer membership of the org may proceed.

Source

Thrown at pkg/http/middleware/authz.go:66

		selectors := []coretypes.Selector{
			coretypes.TypeRole.MustSelector(authtypes.SigNozAdminRoleName),
			coretypes.TypeRole.MustSelector(authtypes.SigNozEditorRoleName),
			coretypes.TypeRole.MustSelector(authtypes.SigNozViewerRoleName),
		}

		err = middleware.authzService.CheckWithTupleCreation(
			ctx,
			claims,
			valuer.MustNewUUID(claims.OrgID),
			authtypes.Relation{Verb: coretypes.VerbAssignee},
			coretypes.NewResourceRole(),
			selectors,
			selectors,
		)
		if err != nil {
			middleware.logger.WarnContext(ctx, authzDeniedMessage, slog.Any("claims", claims))
			if errors.Asc(err, authtypes.ErrCodeAuthZForbidden) {
				render.Error(rw, errors.New(errors.TypeForbidden, authtypes.ErrCodeAuthZForbidden, "only viewers/editors/admins can access this resource"))
				return
			}

			render.Error(rw, err)
			return
		}

		next(rw, req)
	})
}

func (middleware *AuthZ) EditAccess(next http.HandlerFunc) http.HandlerFunc {
	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
		ctx := req.Context()
		claims, err := authtypes.ClaimsFromContext(ctx)
		if err != nil {
			render.Error(rw, err)
			return

View on GitHub (pinned to 5069bf80b0)

Solutions

Verify the token belongs to a user with an active membership (viewer+) in the target org
Re-login or regenerate the token after membership/role changes
Check org ID headers/claims match the resource being accessed

Defensive patterns

Strategy: try-catch

Try / catch

if resp.StatusCode == http.StatusForbidden { /* refresh token, verify org membership */ }

Prevention

Cache role info and re-check membership on 403
Ensure tokens are issued for the correct org

When it happens

Trigger: Calling an API guarded by the viewer-authorization middleware with a JWT that has no viewer/editor/owner role in the organization (e.g. invited-but-not-accepted user, wrong org, or no membership).

Common situations: Token from a different org, revoked/pending invite, API key without org association, or stale JWT after role changes.

Related errors

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/1b09020bbfe06c90. Report an issue: GitHub.