{"record":{"id":"ca6455a061f787c7","repo":"apolloconfig/apollo","slug":"access-is-denied-ca6455","errorCode":null,"errorMessage":"Access is denied","messagePattern":"Access is denied","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceController.java","lineNumber":356,"sourceCode":"        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName);\n  }\n\n  private boolean shouldDenyConfigReadToCurrentIdentity(String appId, String env,\n      String clusterName, String namespaceName) {\n    String authType = UserIdentityContextHolder.getAuthType();\n    return (UserIdentityConstants.USER.equals(authType)\n        || UserIdentityConstants.USER_TOKEN.equals(authType))\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName);\n  }\n\n  private void requireConfigReadForUserToken(String appId, String env, String clusterName,\n      String namespaceName) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n  }\n\n  private void requireReadApplicationPermissionForUserToken(String appId) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && !unifiedPermissionValidator.hasReadApplicationPermission(appId)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n  }\n\n  private void requireCreateNamespacesPermissionForUserToken(\n      List<OpenCreateNamespaceDTO> namespaces) {\n    if (!UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        || CollectionUtils.isEmpty(namespaces)) {\n      return;\n    }\n    for (OpenCreateNamespaceDTO namespace : namespaces) {\n      if (namespace == null || StringUtils.isBlank(namespace.getAppId())) {","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceController.java#L338-L374","documentation":"HTTP 403 (AccessDeniedException). Thrown by NamespaceController.requireConfigReadForUserToken: auth type USER_TOKEN and UnifiedPermissionValidator.shouldHideConfigToCurrentUser is true for appId/env/cluster/namespace. The user-token caller is denied read access to a namespace marked hidden from them. Identical policy to error 86 but on the NamespaceController read surface.","triggerScenarios":"GET namespace/items read endpoints on NamespaceController using a user-token for a restricted/hidden namespace whose visibility rule excludes the token owner.","commonSituations":"User-token owned by an unauthorized user reading a secrets namespace; namespace hidden after token issuance; cross-env token reuse where the owner has no view right.","solutions":["Grant the token owner read/view permission on the namespace or clear the hidden flag.","Switch to a USER session or a CONSUMER token that is authorized for that namespace.","Verify the namespace is meant to be visible to the caller before retrying.","Stop automated reads of namespaces the token owner cannot see."],"exampleFix":"// before: user-token owner excluded from hidden namespace\nclient.withUserToken(token).getNamespace(appId, env, cluster, ns); // 403\n\n// after: authorize the owner, or use an allowed identity\nadmin.grantView(appId, ns, token.getOwnerId());\nclient.withUserToken(token).getNamespace(appId, env, cluster, ns);","handlingStrategy":"validation","validationCode":"// For USER_TOKEN namespace reads: confirm namespace visible to the owner.\nboolean hidden = shouldHide(tokenOwner, appId, env, cluster, ns);\nif (hidden) { /* grant view or skip; do not call getNamespace */ }","typeGuard":"null","tryCatchPattern":"try {\n  client.withUserToken(token).getNamespace(appId, env, cluster, ns);\n} catch (HttpServerErrorException.Forbidden e) {\n  // Access is denied -> hidden namespace; grant view or switch identity\n}","preventionTips":["Grant view permission on restricted namespaces to the token owner.","Avoid reading hidden namespaces from automated clients.","Re-evaluate token scope when namespace visibility changes."],"tags":["apollo-portal","openapi","permission","access-denied","namespace","config-hiding","user-token"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}