{"record":{"id":"12a3bc1ac266a733","repo":"instructure/canvas-lms","slug":"an-object-of-type-graphql-type-was-hidden-due-to","errorCode":null,"errorMessage":"An object of type %{graphql_type} was hidden due to insufficient scopes on access token","messagePattern":"An object of type %(.+?) was hidden due to insufficient scopes on access token","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/canvas_schema.rb","lineNumber":125,"sourceCode":"        when \"ExternalUrl\" then Types::ExternalUrlType\n        when \"ContextExternalTool\" then Types::ModuleExternalToolType\n        end\n      else\n        Types::ModuleItemType\n      end\n    when ContextExternalTool then Types::ExternalToolType\n    when InstitutionalTag            then Types::InstitutionalTagType\n    when InstitutionalTagAssociation then Types::InstitutionalTagAssociationType\n    when InstitutionalTagCategory    then Types::InstitutionalTagCategoryType\n    when Setting then Types::InternalSettingType\n    when AssessmentRequest then Types::AssessmentRequestType\n    when UsageRights then Types::UsageRightsType\n    when ScheduledPost then Types::ScheduledPostType\n    end\n  end\n\n  def self.unauthorized_object(error)\n    raise GraphQL::ExecutionError,\n          I18n.t(\n            \"An object of type %{graphql_type} was hidden due to insufficient scopes on access token\",\n            graphql_type: error.type.graphql_name\n          )\n  end\n\n  orphan_types [Types::PageType,\n                Types::FileType,\n                Types::ExternalUrlType,\n                Types::ExternalToolType,\n                Types::ModuleExternalToolType,\n                Types::ProgressType,\n                Types::ModuleSubHeaderType,\n                Types::InternalSettingType]\n\n  # GraphQL tuning and defensive settings\n  query_analyzer(Analyzers::CanvasAntiabuseAnalyzer)\n  query_analyzer(Analyzers::LogQueryComplexity)","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/canvas_schema.rb#L107-L143","documentation":"Canvas GraphQL scopes limit what an access token can resolve. When a type is reached whose required scope the token lacks, unauthorized_object converts the GraphQL auth error into an ExecutionError saying the object was hidden due to insufficient scopes, so it never leaks existence.","triggerScenarios":"A GraphQL query resolving a field (e.g. submissions, grades) whose type requires a scope (e.g. url or a specific scope string) the developer's access token does not include.","commonSituations":"Personal access tokens created without the needed scopes; tokens minted for read:courses used on gradebook fields; queries that used to work before scopes were added to that type.","solutions":["Regenerate the access token with the required scopes checked for the queried types.","Inspect the field/type definition to find the required scope and request it.","Test the query with an admin/full-scope token to confirm it is scope-related."],"exampleFix":"// before\nAuthorization: Bearer <token with only read:courses>\n// after (create token with required scopes)\nAuthorization: Bearer <token with read:courses, read:submissions>","handlingStrategy":"validation","validationCode":"const requiredScopes = ['url', ...] // scopes declared on queried types\nif (!tokenScopes.includesAll(requiredScopes)) console.warn('token missing scopes:', requiredScopes.filter(s => !tokenScopes.includes(s)))","typeGuard":null,"tryCatchPattern":"try { const data = await graphQL(query, token) } catch (e) { if (e.message.includes('hidden due to insufficient scopes')) { /* regenerate token with needed scopes */ } else throw e }","preventionTips":["Create tokens with all scopes your queries touch","Track required scopes per GraphQL type in client code","Test queries against a full-scope token to isolate scope issues"],"tags":["graphql","oauth","scopes"],"backgroundTag":"insufficient-permissions","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}