{"record":{"id":"8eb68ee0c0b920a8","repo":"flarum/framework","slug":"forbiddenexception","errorCode":null,"errorMessage":"ForbiddenException","messagePattern":"ForbiddenException","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"framework/core/src/Api/Endpoint/Endpoint.php","lineNumber":134,"sourceCode":"        if (strtolower($context->method()) !== strtolower($this->method)) {\n            throw new MethodNotAllowedException();\n        }\n\n        /** @var AbstractResource $collection */\n        $collection = $context->collection;\n\n        $context = $context->withModelId(\n            $collection->id($context)\n        );\n\n        if ($context->modelId) {\n            $context = $context->withModel(\n                $this->findResource($context, $context->modelId)\n            );\n        }\n\n        if (! $this->isVisible($context)) {\n            throw new ForbiddenException();\n        }\n\n        $data = $this->process($context);\n\n        foreach ($this->beforeSerialization as $callback) {\n            $callback($context, $data);\n        }\n\n        if ($this->response) {\n            return ($this->response)($context, $data);\n        }\n\n        if ($context->model && $data instanceof $context->model) {\n            return json_api_response($this->showResource($context, $data));\n        }\n\n        if (is_array($data)) {\n            return json_api_response($data);","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/framework/core/src/Api/Endpoint/Endpoint.php#L116-L152","documentation":"Authorization guard in Endpoint::handle: after resolving the model (via findResource when a model id is present), the endpoint runs isVisible($context); it fires when the authenticated actor fails the endpoint's visibility/authorization checks, so the action is denied with a 403-class ForbiddenException. Generic guard — the input at fault is the actor's lack of permission for the targeted model.","triggerScenarios":"Thrown at framework/core/src/Api/Endpoint/Endpoint.php:134 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Grant the actor the required permission/policy for the resource (check the model's visibility scoping and the group permissions).","Confirm the correct actor/session is being used for the request.","If the denial is unexpected, inspect the endpoint's isVisible/authorize logic and the resource's visibility scopes.","Handle 403 on the client by hiding or disabling the action."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}