{"record":{"id":"91187d022bdacb7b","repo":"Dokploy/dokploy","slug":"forbidden-91187d","errorCode":"FORBIDDEN","errorMessage":"This vault provider is not enabled for the given project/environment","messagePattern":"This vault provider is not enabled for the given project/environment","errorType":"error_code","errorClass":"TRPCError","httpStatus":403,"severity":"error","filePath":"apps/dokploy/server/api/routers/vault-provider.ts","lineNumber":155,"sourceCode":"\t\t\t\t\tctx.user.id,\n\t\t\t\t\tctx.session.activeOrganizationId,\n\t\t\t\t);\n\t\t\t\tif (!accessedProjects.includes(input.projectId)) {\n\t\t\t\t\tthrow new TRPCError({\n\t\t\t\t\t\tcode: \"UNAUTHORIZED\",\n\t\t\t\t\t\tmessage: \"You don't have access to this project\",\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\t!isVaultProviderAssigned(\n\t\t\t\t\tprovider.assignments,\n\t\t\t\t\tinput.projectId,\n\t\t\t\t\tinput.environmentId,\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\tthrow new TRPCError({\n\t\t\t\t\tcode: \"FORBIDDEN\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"This vault provider is not enabled for the given project/environment\",\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn await listVaultProviderSecretNames(provider.config);\n\t\t}),\n});\n","sourceCodeStart":137,"sourceCodeEnd":165,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/apps/dokploy/server/api/routers/vault-provider.ts#L137-L165","documentation":"Thrown by vault-provider endpoints when the provider exists but isVaultProviderAssigned(provider.assignments, input.projectId, input.environmentId) returns false — the provider has no assignment covering that exact project/environment combination. Vault providers must be explicitly enabled per project and environment.","triggerScenarios":"Calling a vault-provider operation with a projectId/environmentId pair that is not in the provider's assignments — e.g. testing a provider for a newly created environment before enabling it there, or using the provider in a different project than assigned.","commonSituations":"Provider assigned to production environment but the request targets a preview/staging environmentId; assignments edited after the page loaded; environment id omitted so it doesn't match the assignment record.","solutions":["Open the vault provider settings and add an assignment for the exact project + environment","Verify both input.projectId and input.environmentId match the assignment values exactly","Reload provider assignments if they were just changed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const assigned = provider.assignments.some(\n  (a) => a.projectId === projectId && a.environmentId === environmentId,\n);\nif (assigned) await runVaultOperation(); else promptEnableProvider();","typeGuard":"const isAssigned = (assignments: Assignment[], projectId: string, environmentId: string) =>\n  assignments.some((a) => a.projectId === projectId && a.environmentId === environmentId);","tryCatchPattern":"catch (e) { if (e?.data?.code === 'FORBIDDEN' && /not enabled/.test(e.message)) openProviderAssignments(); else throw e; }","preventionTips":["Always send both projectId and environmentId explicitly","After creating a new environment, add vault provider assignments for it","Reload assignments when the provider settings modal opens"],"tags":["dokploy","trpc","vault","forbidden","projects","environments"],"backgroundTag":"resource-not-assigned-to-scope","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}