{"record":{"id":"e2db82d2d884411d","repo":"chroma-core/chroma","slug":"you-do-not-have-permission-to-access-the-requested-e2db82","errorCode":null,"errorMessage":"You do not have permission to access the requested resource.","messagePattern":"You do not have permission to access the requested resource\\.","errorType":"http","errorClass":"ChromaForbiddenError","httpStatus":403,"severity":"error","filePath":"clients/new-js/packages/chromadb/src/chroma-fetch.ts","lineNumber":78,"sourceCode":"    return response;\n  }\n\n  switch (response.status) {\n    case 400:\n      let status = \"Bad Request\";\n      try {\n        const responseBody = await response.json();\n        status = responseBody.message || status;\n      } catch {}\n      throw new ChromaClientError(\n        `Bad request to ${\n          (input as Request).url || \"Chroma\"\n        } with status: ${status}`,\n      );\n    case 401:\n      throw new ChromaUnauthorizedError(`Unauthorized`);\n    case 403:\n      throw new ChromaForbiddenError(\n        `You do not have permission to access the requested resource.`,\n      );\n    case 404:\n      throw new ChromaNotFoundError(\n        `The requested resource could not be found`,\n      );\n    case 409:\n      const conflictBody = await getErrorBody(response);\n      if (\n        conflictBody.error === \"ConditionalWriteConflictError\" ||\n        conflictBody.message === \"conditional write conflict\"\n      ) {\n        throw new ChromaConditionalWriteConflictError(\n          conflictBody.message || \"conditional write conflict\",\n        );\n      }\n      throw new ChromaUniqueError(\n        conflictBody.message || \"The resource already exists\",","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/chroma-core/chroma/blob/aecdd12c8a891610db8653630b066b32ceb678b5/clients/new-js/packages/chromadb/src/chroma-fetch.ts#L60-L96","documentation":"Thrown by chromaFetch (chroma-fetch.ts:78) as a ChromaForbiddenError when the Chroma server returns HTTP 403. Unlike 401, authentication succeeded (or is not the issue) but the authenticated principal is not allowed to perform this operation on this resource — the key lacks the required role, scope, or tenant/database access.","triggerScenarios":"Using a read-only API key to create/delete collections or upsert data; accessing a tenant or database the key is not scoped to; RBAC rules on the server denying the role for the endpoint.","commonSituations":"Down-scoped Chroma Cloud keys used by an app that also writes; shared servers where the key belongs to another tenant; role changes after the key was issued.","solutions":["Check the key's permissions/scopes (client.getUserIdentity() for cloud keys) and grant the needed role or use a key with write access.","Confirm the request targets the tenant/database the key actually belongs to.","If RBAC is misconfigured server-side, fix the role assignments for the user/token.","Separate read-only and read-write client instances if your app mixes both access levels."],"exampleFix":"// before\nconst ro = new CloudClient({ apiKey: READ_ONLY_KEY });\nawait ro.createCollection({ name: \"new\" }); // 403 Forbidden\n\n// after\nconst rw = new CloudClient({ apiKey: READ_WRITE_KEY });\nawait rw.createCollection({ name: \"new\" });\nconst reader = new CloudClient({ apiKey: READ_ONLY_KEY }); // use only for queries","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.createCollection({ name });\n} catch (e) {\n  if (e instanceof ChromaForbiddenError) {\n    // authenticated but not permitted: switch to a key with write scope or fix RBAC; do not retry\n  }\n  throw e;\n}","preventionTips":["Use separate read-only and read-write clients and pick the right one per operation.","Verify key scopes with getUserIdentity() during deployment smoke tests.","Document required roles per service so key provisioning matches usage."],"tags":["auth","http-403","rbac","permissions"],"backgroundTag":"permission-denied","analyzedSha":"aecdd12c8a891610db8653630b066b32ceb678b5","analyzedAt":"2026-08-16T21:53:27.228Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}