{"record":{"id":"93bfd92d726c6073","repo":"usestrix/strix","slug":"forbidden","errorCode":"forbidden","errorMessage":"forbidden","messagePattern":"forbidden","errorType":"error_code","errorClass":"RelayError","httpStatus":403,"severity":"error","filePath":"strix/interface/viewer/auth.py","lineNumber":247,"sourceCode":"    The report password is NEVER part of this payload; only the encrypted PDF\n    bytes travel to the relay.\n    \"\"\"\n    payload = {\n        \"token\": token,\n        \"pdf_base64\": base64.b64encode(pdf_bytes).decode(\"ascii\"),\n        \"filename\": filename,\n        \"run_name\": run_name,\n        \"target\": target,\n    }\n    status, _ = _post_json(\"/api/oss/report/send\", payload, timeout=_SEND_TIMEOUT)\n    if status == 200:\n        return\n    if status == 401:\n        raise RelayError(\"reverify\")\n    if status == 413:\n        raise RelayError(\"too_large\")\n    if status == 403:\n        raise RelayError(\"forbidden\")\n    raise RelayError(\"unavailable\")\n\n\n__all__ = [\n    \"AUTH_PATH\",\n    \"RelayError\",\n    \"feedback_submit\",\n    \"forget\",\n    \"is_verified\",\n    \"otp_start\",\n    \"otp_verify\",\n    \"read_auth\",\n    \"report_send\",\n    \"write_auth\",\n]\n","sourceCodeStart":229,"sourceCodeEnd":263,"githubUrl":"https://github.com/usestrix/strix/blob/85513391305171ecc6faffe03da4a8bda5e3febb/strix/interface/viewer/auth.py#L229-L263","documentation":"RelayError('forbidden') raised by report_send() when POST /api/oss/report/send returns 403. Unlike 401 (reverify), 403 means the token is valid but the account is not permitted to use report delivery — the operation is intentionally denied, not merely unauthenticated.","triggerScenarios":"Calling report_send() with a valid, unexpired token whose verification does not carry the entitlement for report sending (e.g. tier/feature gating on the relay side), or an account type the relay restricts. The 403 maps to 'forbidden' distinct from the 401 'reverify' path.","commonSituations":"Relay-side feature gating (report delivery limited to certain verified cohorts); policy change on app.strix.ai after the user last verified; trying to use the send endpoint from an environment or region the relay blocks.","solutions":["Confirm report sending is available to your verification tier; if gated, use local PDF download/export instead","Re-verify with a qualifying work email (see work_email_required) in case entitlement is tied to verification type","Check Strix docs/changelog for announced restrictions on the OSS report relay","If it seems like a mistake, report it via feedback_submit with run details"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"# No reliable client-side pre-check: 403 is a relay-side entitlement decision.\n# Guard by offering local export as the always-available path.\ndef send_report_or_export(pdf, filename):\n    try:\n        report_send(token, pdf, filename, run, target)\n        return \"sent\"\n    except RelayError:\n        save_pdf_locally(pdf, filename)\n        return \"exported-locally\"","typeGuard":null,"tryCatchPattern":"try:\n    report_send(token, pdf, filename, run, target)\nexcept RelayError as e:\n    if e.code == \"forbidden\":\n        show(\"Report delivery is not available for this account; exporting locally instead.\")\n        save_pdf_locally(pdf, filename)\n    else:\n        raise","preventionTips":["Always offer local PDF export as the fallback path","Do not auto-retry 403 — it is a policy denial, not transient","Distinguish 403 (forbidden) from 401 (reverify) in error handling"],"tags":["strix","relay","viewer","auth","report-delivery","authorization"],"backgroundTag":null,"analyzedSha":"85513391305171ecc6faffe03da4a8bda5e3febb","analyzedAt":"2026-08-15T05:03:57.275Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}