{"record":{"id":"c2d76b9952a4c534","repo":"flarum/framework","slug":"permissiondeniedexception","errorCode":null,"errorMessage":"PermissionDeniedException","messagePattern":"PermissionDeniedException","errorType":"http","errorClass":"PermissionDeniedException","httpStatus":403,"severity":"error","filePath":"framework/core/src/Api/Resource/AccessTokenResource.php","lineNumber":133,"sourceCode":"    {\n        $this->events->dispatch(new DeveloperTokenCreated($model));\n\n        return parent::created($model, $context);\n    }\n\n    /**\n     * @param AccessToken $model\n     * @param \\Flarum\\Api\\Context $context\n     * @throws PermissionDeniedException\n     */\n    public function delete(object $model, \\Tobyz\\JsonApiServer\\Context $context): void\n    {\n        /** @var Session|null $session */\n        $session = $context->request->getAttribute('session');\n\n        // Current session should only be terminated through logout.\n        if ($session && $model->token === $session->get('access_token')) {\n            throw new PermissionDeniedException();\n        }\n\n        // Don't give away the existence of the token.\n        if ($context->getActor()->cannot('revoke', $model)) {\n            throw new ModelNotFoundException();\n        }\n\n        $model->delete();\n    }\n}\n","sourceCodeStart":115,"sourceCodeEnd":144,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/framework/core/src/Api/Resource/AccessTokenResource.php#L115-L144","documentation":"Thrown in AccessTokenResource::delete when the token being deleted is the access token of the current session. Deleting it would terminate the caller's own active login, which must only happen through logout, so the deletion is refused with PermissionDeniedException (403).","triggerScenarios":"Thrown at framework/core/src/Api/Resource/AccessTokenResource.php:133 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the logout endpoint instead of DELETE on the token resource to end the current session","Delete a different (non-current) token, e.g. one listed for the user's other devices/sessions","If programmatic termination of the current session is required, invalidate the session directly rather than via the API"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}