{"record":{"id":"7881c72d62246121","repo":"nats-io/nats-server","slug":"subscribe-permission-violation","errorCode":null,"errorMessage":"subscribe permission violation","messagePattern":"subscribe permission violation","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/errors.go","lineNumber":207,"sourceCode":"\tErrNoRespondersRequiresHeaders = errors.New(\"no responders requires headers support\")\n\n\t// ErrClusterNameConfigConflict signals that the options for cluster name in cluster and gateway are in conflict.\n\tErrClusterNameConfigConflict = errors.New(\"cluster name conflicts between cluster and gateway definitions\")\n\n\t// ErrClusterNameRemoteConflict signals that a remote server has a different cluster name.\n\tErrClusterNameRemoteConflict = errors.New(\"cluster name from remote server conflicts\")\n\n\t// ErrClusterNameHasSpaces signals that the cluster name contains spaces, which is not allowed.\n\tErrClusterNameHasSpaces = errors.New(\"cluster name cannot contain spaces\")\n\n\t// ErrClusterNameReserved signals that the cluster name is reserved for internal protocol use.\n\tErrClusterNameReserved = errors.New(\"cluster name is reserved\")\n\n\t// ErrMalformedSubject is returned when a subscription is made with a subject that does not conform to subject rules.\n\tErrMalformedSubject = errors.New(\"malformed subject\")\n\n\t// ErrSubscribePermissionViolation is returned when processing of a subscription fails due to permissions.\n\tErrSubscribePermissionViolation = errors.New(\"subscribe permission violation\")\n\n\t// ErrNoTransforms signals no subject transforms are available to map this subject.\n\tErrNoTransforms = errors.New(\"no matching transforms available\")\n\n\t// ErrCertNotPinned is returned when pinned certs are set and the certificate is not in it\n\tErrCertNotPinned = errors.New(\"certificate not pinned\")\n\n\t// ErrDuplicateServerName is returned when processing a server remote connection and\n\t// the server reports that this server name is already used in the cluster.\n\tErrDuplicateServerName = errors.New(\"duplicate server name\")\n\n\t// ErrMinimumVersionRequired is returned when a connection is not at the minimum version required.\n\tErrMinimumVersionRequired = errors.New(\"minimum version required\")\n\t// ErrLeafNodeMinVersionRejected is the leafnode protocol error prefix used\n\t// when rejecting a remote due to leafnodes.min_version.\n\tErrLeafNodeMinVersionRejected = errors.New(\"connection rejected since minimum version required is\")\n\n\t// ErrInvalidMappingDestination is used for all subject mapping destination errors","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/errors.go#L189-L225","documentation":"The account's permission rules deny this client from subscribing to the requested subject — an explicit deny rule matched, or no allow rule covers it (canSubscribe failed). subPermissionViolation fires for accounting/events before the sentinel is returned from processSub.","triggerScenarios":"Thrown at server/errors.go:207 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Extend the account's subscribe allow permissions to cover the subject","Subscribe to a subject or wildcard within the allow list","Check the deny list for an overly broad pattern"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}