{"record":{"id":"811e0d5e7f0b1d98","repo":"phacility/phabricator","slug":"you-do-not-have-access-to-the-application-which-pr","errorCode":null,"errorMessage":"You do not have access to the application which provides this API method.","messagePattern":"You do not have access to the application which provides this API method\\.","errorType":"exception","errorClass":"ConduitException","httpStatus":null,"severity":"error","filePath":"src/applications/conduit/call/ConduitCall.php","lineNumber":123,"sourceCode":"      if (!$allow_public) {\n        if (!$user->isLoggedIn() && !$user->isOmnipotent()) {\n          // TODO: As per below, this should get centralized and cleaned up.\n          throw new ConduitException('ERR-INVALID-AUTH');\n        }\n      }\n\n      // TODO: This would be slightly cleaner by just using a Query, but the\n      // Conduit auth workflow requires the Call and User be built separately.\n      // Just do it this way for the moment.\n      $application = $this->handler->getApplication();\n      if ($application) {\n        $can_view = PhabricatorPolicyFilter::hasCapability(\n          $user,\n          $application,\n          PhabricatorPolicyCapability::CAN_VIEW);\n\n        if (!$can_view) {\n          throw new ConduitException(\n            pht(\n              'You do not have access to the application which provides this '.\n              'API method.'));\n        }\n      }\n    }\n\n    return $this->handler->executeMethod($this->request);\n  }\n\n  protected function buildMethodHandler($method_name) {\n    $method = ConduitAPIMethod::getConduitMethod($method_name);\n\n    if (!$method) {\n      throw new ConduitMethodDoesNotExistException($method_name);\n    }\n\n    $application = $method->getApplication();","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/conduit/call/ConduitCall.php#L105-L141","documentation":"After authentication succeeds, ConduitCall runs the calling user through PhabricatorPolicyFilter against PhabricatorPolicyCapability::CAN_VIEW on the application that owns the method. If the user cannot view that application (e.g. it is restricted to an admin-only policy), the call is rejected — a policy/authorization denial, not a missing-credential problem like ERR-INVALID-AUTH.","triggerScenarios":"A normal user (or a bot token whose owner lacks rights) calling a method provided by an application whose view policy excludes them — e.g. a Policies-restricted 'Differential' application and a differential.revision.query call; A newly installed application that defaults to administrator-only policies; A daemon/script using a token belonging to a user who was demoted or removed from the required project","commonSituations":"Hardening passes that lock application policies down to admins, silently breaking bot integrations; per-user API tokens inheriting their owner's policy visibility; new hires calling tools before being granted access to the relevant applications.","solutions":["Grant the user (or the token owner) view access: adjust the application's policy in Applications -> <app> -> Edit Policies, or add the user to the allowed project","Use a token owned by a user/bot that already has view access to that application","Verify access programmatically with PhabricatorPolicyFilter::hasCapability($user, $app, PhabricatorPolicyCapability::CAN_VIEW) before making the call"],"exampleFix":"// before\n$user = id(new PhabricatorPeopleQuery())\n  ->setViewer($admin)\n  ->withUsernames(array('ci-bot'))\n  ->executeOne();\n$response = id(new ConduitCall('differential.revision.query', array()))\n  ->setUser($user)\n  ->execute();\n\n// after: check capability first, surface a clear message\n$application = PhabricatorApplication::getByClass('DifferentialApplication');\nif (!PhabricatorPolicyFilter::hasCapability(\n      $user, $application, PhabricatorPolicyCapability::CAN_VIEW)) {\n  throw new Exception('Grant ci-bot view access to Differential.');\n}\n$response = id(new ConduitCall('differential.revision.query', array()))\n  ->setUser($user)\n  ->execute();","handlingStrategy":"validation","validationCode":"$application = PhabricatorApplication::getByClass($app_class);\nif (!PhabricatorPolicyFilter::hasCapability(\n      $viewer, $application, PhabricatorPolicyCapability::CAN_VIEW)) {\n  throw new Exception(\n    pht('User %s cannot view application %s.',\n      $viewer->getUsername(), $application->getName()));\n}\n$response = id(new ConduitCall($method, $params))\n  ->setUser($viewer)\n  ->execute();","typeGuard":null,"tryCatchPattern":"try {\n  $result = id(new ConduitCall($method, $params))->setUser($viewer)->execute();\n} catch (ConduitException $ex) {\n  if (strpos($ex->getMessage(), 'do not have access to the application') !== false) {\n    // Authorization problem: report which application policy blocked the user.\n  }\n  throw $ex;\n}","preventionTips":["Before shipping bot integrations, verify the token owner can view every application the script touches","When tightening application policies, audit existing API tokens for breakage in the same change","Use PhabricatorPolicyFilter::hasCapability as a preflight check in multi-app scripts to fail with a precise message"],"tags":["phabricator","conduit","authorization","policy-filter","access-control"],"backgroundTag":"application-permission-denied","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}