{"record":{"id":"6408509d79e44389","repo":"apolloconfig/apollo","slug":"access-is-denied-640850","errorCode":null,"errorMessage":"Access is denied","messagePattern":"Access is denied","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ReleaseController.java","lineNumber":205,"sourceCode":"        releaseService.loadLatestRelease(appId, Env.valueOf(env), clusterName, namespaceName);\n    if (release == null) {\n      return ResponseEntity.ok().build();\n    }\n    return ResponseEntity.ok(OpenApiModelConverters.fromReleaseDTO(release));\n  }\n\n  @Override\n  public ResponseEntity<Void> rollback(String env, Long releaseId, String operator,\n      Long toReleaseId) {\n    ReleaseDTO release = releaseService.findReleaseById(Env.valueOf(env), releaseId);\n    if (release == null) {\n      throw NotFoundException.releaseNotFound(releaseId);\n    }\n    String resolvedOperator = resolveOperator(operator, null);\n\n    if (!unifiedPermissionValidator.hasReleaseNamespacePermission(release.getAppId(), env,\n        release.getClusterName(), release.getNamespaceName())) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n\n    if (toReleaseId != null && toReleaseId > -1) {\n      releaseService.rollbackTo(Env.valueOf(env), releaseId, toReleaseId, resolvedOperator);\n    } else {\n      releaseService.rollback(Env.valueOf(env), releaseId, resolvedOperator);\n    }\n\n    ConfigPublishEvent event = ConfigPublishEvent.instance();\n    event.withAppId(release.getAppId()).withCluster(release.getClusterName())\n        .withNamespace(release.getNamespaceName()).withPreviousReleaseId(releaseId)\n        .setRollbackEvent(true).setEnv(Env.valueOf(env));\n    publisher.publishEvent(event);\n    return ResponseEntity.ok().build();\n  }\n\n  private NamespaceReleaseModel toReleaseModel(String appId, String env, String clusterName,\n      String namespaceName, NamespaceReleaseDTO releaseDTO, String releasedBy) {","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ReleaseController.java#L187-L223","documentation":"Thrown by the rollback endpoint when the current identity lacks release permission on the target namespace. The permission check uses unifiedPermissionValidator.hasReleaseNamespacePermission with the release's appId, cluster, and namespace.","triggerScenarios":"Thrown when an OpenAPI consumer or portal user calls the release endpoint without the required release permission for the target app/namespace, or when the access check in ReleaseController fails.","commonSituations":"A consumer token lacks release permission on the namespace; the operator resolved from the request is not authorized; missing or expired token.","solutions":["Authenticate as an identity that has release permission on the namespace being rolled back (appId, env, cluster, namespace).","If calling via OpenAPI, use a consumer token or user token whose scope includes release permission for this namespace.","Have a super admin or app admin grant your user/token the release role for the namespace in the Apollo portal permission management page."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}