{"record":{"id":"ff4471f3ae94ccbd","repo":"apolloconfig/apollo","slug":"access-is-denied-ff4471","errorCode":null,"errorMessage":"Access is denied","messagePattern":"Access is denied","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceBranchController.java","lineNumber":301,"sourceCode":"      return operator;\n    }\n\n    throw new BadRequestException(\"Unsupported auth type: %s\", authType);\n  }\n\n  private boolean shouldHideConfigToCurrentUser(String appId, String env, String clusterName,\n      String namespaceName) {\n    return UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName);\n  }\n\n  private void requireConfigReadForUserToken(String appId, String env, String clusterName,\n      String namespaceName) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,\n            namespaceName)) {\n      throw new AccessDeniedException(\"Access is denied\");\n    }\n  }\n}\n","sourceCodeStart":283,"sourceCodeEnd":305,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceBranchController.java#L283-L305","documentation":"HTTP 403 (AccessDeniedException). Thrown by NamespaceBranchController.requireConfigReadForUserToken when the auth type is USER_TOKEN and UnifiedPermissionValidator.shouldHideConfigToCurrentUser returns true for the given appId/env/cluster/namespace. This is the config-hiding / restricted-namespace feature: certain namespaces are marked hidden from non-privileged users, and a user-token caller whose access would be hidden is denied outright on branch-read endpoints.","triggerScenarios":"GET find-branch (or other branch read) using a user-token for a namespace flagged hidden-from-current-user (e.g. a secret/credentials namespace restricted to a specific team) where the token's owner is not in the allowed set.","commonSituations":"A user-token owned by a user outside the namespace's authorized team reading a restricted namespace; namespace visibility changed to hidden after the token was issued; token reused across apps where the owner lacks view rights.","solutions":["Grant the token owner view/read permission on the hidden namespace, or remove the hidden restriction for that namespace.","Use a portal USER session or a CONSUMER OpenAPI token that has been granted access instead of a restricted user-token.","Confirm the namespace is intended to be visible to the caller's identity before requesting it.","If access is legitimately denied, stop reading that namespace from the automated client."],"exampleFix":"// before: user-token owner not authorized for hidden namespace\nclient.withUserToken(restrictedToken).findBranch(appId, env, cluster, ns); // 403\n\n// after: grant view permission to the owner, or use an authorized token\nadmin.grantView(appId, ns, ownerId);\nclient.withUserToken(authorizedToken).findBranch(appId, env, cluster, ns);","handlingStrategy":"validation","validationCode":"// For USER_TOKEN branch reads: confirm the namespace is not hidden from the owner.\nboolean hidden = shouldHide(tokenOwner, appId, env, cluster, ns); // via role/visibility probe\nif (hidden) { /* grant view or skip; do not call findBranch */ }","typeGuard":"null","tryCatchPattern":"try {\n  client.withUserToken(token).findBranch(appId, env, cluster, ns);\n} catch (HttpServerErrorException.Forbidden e) {\n  // Access is denied -> namespace hidden from token owner; grant view or switch identity\n}","preventionTips":["Grant the user-token owner view permission on restricted namespaces before reading.","Do not reuse a token across namespaces its owner cannot see.","Track which namespaces are marked hidden and exclude them from automated reads."],"tags":["apollo-portal","openapi","permission","access-denied","namespace-branch","config-hiding","user-token"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}