{"record":{"id":"fd79b22a7eea9aa3","repo":"docker/compose","slug":"forbidden","errorCode":null,"errorMessage":"forbidden","messagePattern":"forbidden","errorType":"error_code","errorClass":"ErrForbidden","httpStatus":null,"severity":"error","filePath":"pkg/api/errors.go","lineNumber":35,"sourceCode":"package api\n\nimport (\n\t\"errors\"\n)\n\nconst (\n\t// ExitCodeLoginRequired exit code when command cannot execute because it requires cloud login\n\t// This will be used by VSCode to detect when creating context if the user needs to login first\n\tExitCodeLoginRequired = 5\n)\n\nvar (\n\t// ErrNotFound is returned when an object is not found\n\tErrNotFound = errors.New(\"not found\")\n\t// ErrAlreadyExists is returned when an object already exists\n\tErrAlreadyExists = errors.New(\"already exists\")\n\t// ErrForbidden is returned when an operation is not permitted\n\tErrForbidden = errors.New(\"forbidden\")\n\t// ErrUnknown is returned when the error type is unmapped\n\tErrUnknown = errors.New(\"unknown\")\n\t// ErrNotImplemented is returned when a backend doesn't implement an action\n\tErrNotImplemented = errors.New(\"not implemented\")\n\t// ErrUnsupportedFlag is returned when a backend doesn't support a flag\n\tErrUnsupportedFlag = errors.New(\"unsupported flag\")\n\t// ErrCanceled is returned when the command was canceled by user\n\tErrCanceled = errors.New(\"canceled\")\n\t// ErrParsingFailed is returned when a string cannot be parsed\n\tErrParsingFailed = errors.New(\"parsing failed\")\n\t// ErrNoResources is returned when operation didn't selected any resource\n\tErrNoResources = errors.New(\"no resources\")\n)\n\n// IsNotFoundError returns true if the unwrapped error is ErrNotFound\nfunc IsNotFoundError(err error) bool {\n\treturn errors.Is(err, ErrNotFound)\n}","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/api/errors.go#L17-L53","documentation":"api.ErrForbidden is the sentinel returned when an operation is not permitted — typically authorization failure against the backend (e.g. a cloud backend rejecting an action for the current credentials). It exists so the CLI and library consumers can map permission problems consistently rather than parse strings.","triggerScenarios":"Calling an api operation the authenticated principal lacks rights for; a compose (cloud) backend receiving an HTTP 403 and wrapping it as ErrForbidden for the caller.","commonSituations":"Expired or scoped-down Docker accounts/tokens used with the cloud backend; org-level RBAC denying registry or environment access; using a read-only token for mutating operations.","solutions":["Re-authenticate with an account that has the required permissions (docker login).","Check token scopes / org policies for the operation you are attempting.","In Go code, detect with errors.Is(err, api.ErrForbidden) and surface a permission message rather than retrying."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isForbidden(err error) bool { return errors.Is(err, api.ErrForbidden) }","tryCatchPattern":"if err := op(ctx); err != nil {\n    if errors.Is(err, api.ErrForbidden) {\n        // stop and prompt re-login / report permission gap; do not retry\n        return fmt.Errorf(\"permission denied: %w\", err)\n    }\n    return err\n}","preventionTips":["Verify credentials and token scopes before running mutating operations.","Never auto-retry forbidden operations — fix authorization first."],"tags":["api","sentinel-error","authorization"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}