{"record":{"id":"93c540ab09c4daf9","repo":"apolloconfig/apollo","slug":"access-is-denied-93c540","errorCode":null,"errorMessage":"Access is denied","messagePattern":"Access is denied","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/InstanceController.java","lineNumber":137,"sourceCode":"    }\n    checkConfigReadAllowed(appId, env, clusterName, namespaceName);\n    return ResponseEntity.ok(instanceService.getInstanceCountByNamespace(appId, Env.valueOf(env),\n        clusterName, namespaceName));\n  }\n\n  private boolean shouldHideConfigToPortalUser(String appId, String env, String clusterName,\n      String namespaceName) {\n    return UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName);\n  }\n\n  private void checkConfigReadAllowed(String appId, String env, String clusterName,\n      String namespaceName) {\n    String authType = UserIdentityContextHolder.getAuthType();\n    if (UserIdentityConstants.USER_TOKEN.equals(authType) && unifiedPermissionValidator\n        .shouldHideConfigToCurrentUser(appId, env, clusterName, namespaceName)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n    if (UserIdentityConstants.CONSUMER.equals(authType) && !unifiedPermissionValidator\n        .hasReleaseNamespacePermission(appId, env, clusterName, namespaceName)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n  }\n\n  private ReleaseDTO findReleaseOrThrow(Env env, long releaseId) {\n    ReleaseDTO release = releaseService.findReleaseById(env, releaseId);\n    if (release == null) {\n      throw NotFoundException.releaseNotFound(releaseId);\n    }\n    return release;\n  }\n\n  private void checkReleaseReadAllowed(String env, ReleaseDTO release) {\n    if ((UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())\n        || UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType()))","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/InstanceController.java#L119-L155","documentation":"Thrown by InstanceController.checkConfigReadAllowed when a USER_TOKEN identity attempts to read instance/config data for a namespace that is hidden from the current user. The shouldHideConfigToCurrentUser check evaluates the token holder's role against the namespace's visibility rules. Maps to HTTP 403 AccessDeniedException.","triggerScenarios":"GET instance-by-namespace or instance-by-release endpoints with a USER_TOKEN where the namespace is configured as hidden (e.g. the token holder is not the app's admin and has no edit/release role for that namespace).","commonSituations":"A namespace has restricted visibility (common for production secrets), and a personal access token whose holder has read-only or no access to that namespace attempts to list its instances. The hide-config feature is designed to prevent unauthorized exposure of sensitive configuration data.","solutions":["Grant the token holder's account edit or release permission on the target namespace via the Portal permission management page.","Use a CONSUMER token that has release-namespace permission on the target app/env/cluster/namespace.","Switch to an account that is an app administrator for the target app."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before instance read with USER_TOKEN, verify the namespace is not hidden\nif (authType.equals(\"USER_TOKEN\") && isNamespaceHidden(appId, env, clusterName, namespaceName)) {\n    throw new SecurityException(\"Namespace is hidden from the current user. Grant edit/release permission.\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return client.get(\"/openapi/v1/envs/\" + env + \"/apps/\" + appId + \"/clusters/\" + clusterName\n        + \"/namespaces/\" + namespaceName + \"/instances\");\n} catch (AccessDeniedException e) {\n    logger.warn(\"USER_TOKEN denied instance read on namespace. Check namespace visibility settings.\");\n    throw e;\n}","preventionTips":["Before reading instances, verify the token holder has edit or release permission on the namespace.","For restricted namespaces, use a dedicated token with explicit namespace access.","Document which namespaces are restricted and which tokens have access."],"tags":["authorization","openapi","instance","permissions","user-token","namespace-visibility","access-control","http-403"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}