{"record":{"id":"e0503c295231e557","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-e0503c","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/collections/operations/deleteByID.ts","lineNumber":132,"sourceCode":"    // Exclude trashed documents when trash: false\n    where = appendNonTrashedFilter({\n      enableTrash: collectionConfig.trash,\n      trash,\n      where,\n    })\n\n    const docToDelete = await req.payload.db.findOne({\n      collection: collectionConfig.slug,\n      locale: req.locale!,\n      req,\n      where,\n    })\n\n    if (!docToDelete && !hasWhereAccess) {\n      throw new NotFound(req.t)\n    }\n    if (!docToDelete && hasWhereAccess) {\n      throw new Forbidden(req.t)\n    }\n\n    // /////////////////////////////////////\n    // Handle potentially locked documents\n    // /////////////////////////////////////\n\n    await checkDocumentLockStatus({\n      id,\n      collectionSlug: collectionConfig.slug,\n      lockErrorMessage: `Document with ID ${id} is currently locked and cannot be deleted.`,\n      overrideLock,\n      req,\n    })\n\n    await deleteAssociatedFiles({\n      collectionConfig,\n      config,\n      doc: docToDelete!,","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/collections/operations/deleteByID.ts#L114-L150","documentation":"In `deleteByIDOperation`, if `docToDelete` is null AND `hasWhereAccess` is true, it throws `Forbidden`. The user's `access.delete` returned a where-constraint that excluded this document, so Payload signals denial rather than revealing existence.","triggerScenarios":"Deleting a document where the user's `access.delete` returns a `where` clause and no document matches both the requested ID and that access constraint.","commonSituations":"Role-based access control; multi-tenant setup where a user may only delete their own docs; the doc is owned by another user.","solutions":["Verify the user actually has delete access to that document.","Use `overrideAccess: true` in trusted server-side code.","Adjust the collection's `access.delete` function if it is too restrictive."],"exampleFix":"// before\nawait payload.deleteByID({ collection: 'posts', id })\n// after (server-side privileged)\nawait payload.deleteByID({ collection: 'posts', id, overrideAccess: true })","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isForbidden(e): boolean {\n  return e?.statusCode === 403 || e?.name === 'Forbidden'\n}","tryCatchPattern":"try {\n  await payload.deleteByID({ collection, id })\n} catch (e) {\n  if (isForbidden(e)) notifyUser('You do not have permission to delete this.')\n  else throw e\n}","preventionTips":["Only show delete actions for documents the user can delete.","Handle `Forbidden` distinctly from `NotFound` in the UI.","Use `overrideAccess` only in trusted server-side flows."],"tags":["delete","access-control","forbidden"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}