SigNoz/signoz · critical

ErrCodeAuthZUnavailable

ErrCodeAuthZUnavailable

Error message

failed to read tuples from authorization server

What it means

Thrown by SigNoz's OpenFGA authorization server wrapper when the embedded openfgaServer.Read RPC (listing relationship tuples, with pagination via continuation tokens) fails. It wraps the gRPC error with ErrCodeAuthZUnavailable, signaling the authorization backend is not usable right now.

Source

Thrown at pkg/authz/openfgaserver/server.go:299

		return err
	}

	return nil
}

func (server *Server) ReadTuples(ctx context.Context, tupleKey *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error) {
	storeID, _ := server.getStoreIDandModelID()
	var tuples []*openfgav1.TupleKey
	continuationToken := ""

	for {
		response, err := server.openfgaServer.Read(ctx, &openfgav1.ReadRequest{
			StoreId:           storeID,
			TupleKey:          tupleKey,
			ContinuationToken: continuationToken,
		})
		if err != nil {
			return nil, errors.Wrapf(err, errors.TypeInternal, authtypes.ErrCodeAuthZUnavailable, "failed to read tuples from authorization server")
		}

		for _, tuple := range response.Tuples {
			tuples = append(tuples, tuple.Key)
		}

		if response.ContinuationToken == "" {
			break
		}
		continuationToken = response.ContinuationToken
	}

	return tuples, nil
}

func (server *Server) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType coretypes.Type) ([]*coretypes.Object, error) {
	storeID, modelID := server.getStoreIDandModelID()
	response, err := server.openfgaServer.ListObjects(ctx, &openfgav1.ListObjectsRequest{

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Check OpenFGA server logs and its datastore connectivity (DB up, migrations applied)
2. Verify the store ID being passed corresponds to an existing OpenFGA store (getOrCreateStore succeeded)
3. Increase the context timeout/deadline for large tuple reads
4. Restart the OpenFGA component; if persistent, recreate the store and re-sync tuples

tuples, err := server.ReadTuples(ctx, storeID, tupleKey, token)
if err != nil {
	if errors.Is(err, authtypes.ErrCodeAuthZUnavailable) { backoff.Retry(...) }
}

When it happens

Trigger: Calling ReadTuples while iterating pages with a continuation token and the OpenFGA storage (Postgres/MySQL) is down, the store ID is invalid, the request context times out, or the authorization model/tuple keys are malformed.

Common situations: OpenFGA datastore misconfiguration (bad DSN, wrong store ID); OpenFGA container crash-looping in the SigNoz deployment; large tuple sets exceeding request deadlines; version mismatch between the embedded OpenFGA server and the client proto.

Related errors

• CodeTooManyRequests
• CodeInvalidInput
• CodeInternal
• ErrCodeRoleInvalidInput

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/4eaec0619008cee6. Report an issue: GitHub.