{"record":{"id":"c4a42bfd23917e6d","repo":"clockworklabs/SpacetimeDB","slug":"permission-denied-for-domains-domains","errorCode":null,"errorMessage":"Permission denied for domains: {domains:?}","messagePattern":"Permission denied for domains: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/cli/src/subcommands/dns.rs","lineNumber":55,"sourceCode":"    let builder = reqwest::Client::new()\n        .put(format!(\n            \"{}/v1/database/{database_identity}/names\",\n            config.get_host_url(server)?\n        ))\n        .header(reqwest::header::CONTENT_TYPE, \"application/json\")\n        .body(serde_json::to_string(&[&domain])?);\n    let builder = add_auth_header_opt(builder, &auth_header);\n\n    let response = builder.send().await?;\n    let status = &response.status();\n    let result: SetDomainsResult = response.json_or_error().await?;\n\n    if !status.is_success() {\n        anyhow::bail!(match result {\n            SetDomainsResult::Success => \"\".to_string(),\n            SetDomainsResult::PermissionDenied { domain } => format!(\"Permission denied for domain: {domain}\"),\n            SetDomainsResult::PermissionDeniedOnAny { domains } =>\n                format!(\"Permission denied for domains: {domains:?}\"),\n            SetDomainsResult::DatabaseNotFound => format!(\"Database {database_identity} not found\"),\n            SetDomainsResult::NotYourDatabase { .. } =>\n                format!(\"You cannot rename {database_identity} because it is owned by another identity.\"),\n            SetDomainsResult::OtherError(err) => err,\n        });\n    }\n\n    println!(\"Name set to {domain} for identity {database_identity}.\");\n\n    Ok(())\n}\n","sourceCodeStart":37,"sourceCodeEnd":67,"githubUrl":"https://github.com/clockworklabs/SpacetimeDB/blob/524b4487d949b61a07d4f39c862d1290259dfd20/crates/cli/src/subcommands/dns.rs#L37-L67","documentation":"Multi-domain variant of the rename permission failure: the server returned `PermissionDeniedOnAny { domains }` — of the requested domain(s), at least one is not permitted for the authenticated identity. The CLI formats the whole offending list into the error. It comes from the same `PUT /v1/database/{identity}/names` endpoint used by `spacetime rename`.","triggerScenarios":"The request body carries a list of domains (the CLI sends one, but the endpoint/API accepts several) and any element is owned/reserved by another party; typically surfaces with multi-name tooling built on the same HTTP API rather than the bare CLI.","commonSituations":"Custom scripts calling the names endpoint with several candidate domains; partial ownership where you control some names but not others in the list.","solutions":["Read the `domains` list in the message and drop or replace each denied name","Retry with only domains you own, one at a time, to isolate the offender","Verify the authenticated identity matches the domain owner (`spacetime identity show`)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// If driving the HTTP API directly, validate ownership per domain first\nfor d in domains { if !owned(&client, &d)? { return Err(format!(\"not owned: {d}\")); } }","typeGuard":"fn is_denied(msg: &str) -> bool { msg.starts_with(\"Permission denied for domains:\") }","tryCatchPattern":"// Parse the domains list out of the error, retry the request with only the permitted subset, and report the excluded names to the operator.","preventionTips":["Batch only domains under one ownership boundary","Confirm ownership with the operator's policy before requesting reserved names"],"tags":["cli","dns","rename","permissions","spacetimedb"],"backgroundTag":"permission-denied","analyzedSha":"524b4487d949b61a07d4f39c862d1290259dfd20","analyzedAt":"2026-08-16T23:58:54.611Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}