{"record":{"id":"ce98c2e40f777c2d","repo":"microsoft/semantic-kernel","slug":"received-a-request-from-a-bot-with-an-app-id-of","errorCode":null,"errorMessage":"Received a request from a bot with an app ID of \"{app_id}\". To enable requests from this caller, add the app ID to your configuration file.","messagePattern":"Received a request from a bot with an app ID of \"(.+?)\"\\. To enable requests from this caller, add the app ID to your configuration file\\.","errorType":"exception","errorClass":"PermissionError","httpStatus":null,"severity":"error","filePath":"python/samples/demos/copilot_studio_skill/src/api/auth.py","lineNumber":34,"sourceCode":"\n        # ALLOWED_CALLERS is the setting in config.py file\n        # that consists of the list of parent bot ids that are allowed to access the skill\n        # to add a new parent bot simply go to the AllowedCallers and add\n        # the parent bot's microsoft app id to the list\n        caller_list = getattr(config, self.config_key)\n        if caller_list is None:\n            raise TypeError(f'\"{self.config_key}\" not found in configuration.')\n        self._allowed_callers = frozenset(caller_list)\n\n    @property\n    def claims_validator(self) -> Callable[[list[dict]], Awaitable]:\n        async def allow_callers_claims_validator(claims: dict[str, object]):\n            # if allowed_callers is None we allow all calls\n            if \"*\" not in self._allowed_callers and SkillValidation.is_skill_claim(claims):\n                # Check that the appId claim in the skill request is in the list of skills configured for this bot.\n                app_id = JwtTokenValidation.get_app_id_from_claims(claims)\n                if app_id not in self._allowed_callers:\n                    raise PermissionError(\n                        f'Received a request from a bot with an app ID of \"{app_id}\".'\n                        f\" To enable requests from this caller, add the app ID to your configuration file.\"\n                    )\n\n            return\n\n        return allow_callers_claims_validator\n","sourceCodeStart":16,"sourceCodeEnd":42,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/samples/demos/copilot_studio_skill/src/api/auth.py#L16-L42","documentation":"A PermissionError raised by the claims validator when an incoming skill request carries an app ID (from JWT claims) that is not in the configured ALLOWED_CALLERS set, and wildcard '*' is not configured. This is the core authorization gate: only explicitly allow-listed parent bots may invoke the skill.","triggerScenarios":"A parent bot sends a skill request; SkillValidation.is_skill_claim(claims) is true; the claim's appId is not in self._allowed_callers; ALLOWED_CALLERS is not ['*'].","commonSituations":"A new parent bot was deployed without adding its app ID to ALLOWED_CALLERS; wrong tenant/app registration used; misconfigured allowed callers; a legitimate partner bot not yet allow-listed.","solutions":["Add the offending app ID (shown in the message) to the ALLOWED_CALLERS env var / Config.","Temporarily set ALLOWED_CALLERS to '*' only in trusted/dev environments to allow all (not for production).","Verify the parent bot's app registration ID matches what was added."],"exampleFix":"// before\nALLOWED_CALLERS=11111111-2222-3333-4444-555555555555\n# requesting bot is 99999999-aaaa-bbbb-cccc-dddddddddddd\n\n// after\nALLOWED_CALLERS=11111111-2222-3333-4444-555555555555,99999999-aaaa-bbbb-cccc-dddddddddddd","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    await claims_validator(claims)\nexcept PermissionError as e:\n    app_id = JwtTokenValidation.get_app_id_from_claims(claims)\n    logger.warning(\"Unauthorized caller app_id=%s; add to ALLOWED_CALLERS if intended.\", app_id)\n    raise","preventionTips":["Maintain ALLOWED_CALLERS as part of deployment config, updated whenever a new parent bot is onboarded.","Use '*' only in isolated dev environments, never production."],"tags":["authorization","authentication","bot-framework","copilot-studio","security"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}