{"record":{"id":"49170da21473fc90","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-49170d","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/collections/operations/findDistinct.ts","lineNumber":134,"sourceCode":"      where: where ?? {},\n    })\n\n    const fieldResult = getFieldByPath({\n      config: payload.config,\n      fields: collectionConfig.flattenedFields,\n      includeRelationships: true,\n      path: args.field,\n    })\n\n    if (!fieldResult) {\n      throw new APIError(\n        `Field ${args.field} was not found in the collection ${collectionConfig.slug}`,\n        httpStatus.BAD_REQUEST,\n      )\n    }\n\n    if (fieldResult.field.hidden && !showHiddenFields) {\n      throw new Forbidden(req.t)\n    }\n\n    if (fieldResult.field.access?.read) {\n      const hasAccess = await fieldResult.field.access.read({\n        collection: collectionConfig,\n        req,\n      })\n      if (!hasAccess) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    await validateSortQuery({\n      collectionConfig,\n      overrideAccess: overrideAccess!,\n      req,\n      sort: args.sort,\n    })","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/collections/operations/findDistinct.ts#L116-L152","documentation":"In `findDistinctOperation`, if the resolved field is `hidden` and the caller did not pass `showHiddenFields: true`, it throws `Forbidden`. Hidden fields are excluded from distinct queries unless explicitly requested with privilege.","triggerScenarios":"Running findDistinct on a field marked `hidden: true` in its field config, without `showHiddenFields: true`.","commonSituations":"Querying an internal/admin field that was marked hidden; admin tooling forgetting to pass `showHiddenFields`.","solutions":["Pass `showHiddenFields: true` (and ensure the caller is privileged).","Choose a non-hidden field for the distinct query."],"exampleFix":"// before\nawait payload.findDistinct({ collection: 'posts', field: 'internalFlag' })\n// after\nawait payload.findDistinct({ collection: 'posts', field: 'internalFlag', showHiddenFields: true, overrideAccess: true })","handlingStrategy":"validation","validationCode":"function canQueryField(fieldConfig, showHiddenFields) {\n  return !fieldConfig.hidden || showHiddenFields\n}","typeGuard":"function isHiddenField(field): boolean {\n  return !!field?.hidden\n}","tryCatchPattern":"try {\n  await payload.findDistinct({ collection, field })\n} catch (e) {\n  if (e?.statusCode === 403 || e?.name === 'Forbidden') notifyNoAccess()\n  else throw e\n}","preventionTips":["Do not expose hidden fields in user-facing distinct dropdowns.","Pass `showHiddenFields` + `overrideAccess` only in admin contexts."],"tags":["distinct","access-control","hidden-fields","forbidden"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}