apolloconfig/apollo · error · AccessDeniedException

Access is denied

Error message

Access is denied

What it means

Thrown by the rollback endpoint when the current identity lacks release permission on the target namespace. The permission check uses unifiedPermissionValidator.hasReleaseNamespacePermission with the release's appId, cluster, and namespace.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/ReleaseController.java:205

        releaseService.loadLatestRelease(appId, Env.valueOf(env), clusterName, namespaceName);
    if (release == null) {
      return ResponseEntity.ok().build();
    }
    return ResponseEntity.ok(OpenApiModelConverters.fromReleaseDTO(release));
  }

  @Override
  public ResponseEntity<Void> rollback(String env, Long releaseId, String operator,
      Long toReleaseId) {
    ReleaseDTO release = releaseService.findReleaseById(Env.valueOf(env), releaseId);
    if (release == null) {
      throw NotFoundException.releaseNotFound(releaseId);
    }
    String resolvedOperator = resolveOperator(operator, null);

    if (!unifiedPermissionValidator.hasReleaseNamespacePermission(release.getAppId(), env,
        release.getClusterName(), release.getNamespaceName())) {
      throw new AccessDeniedException("Access is denied");
    }

    if (toReleaseId != null && toReleaseId > -1) {
      releaseService.rollbackTo(Env.valueOf(env), releaseId, toReleaseId, resolvedOperator);
    } else {
      releaseService.rollback(Env.valueOf(env), releaseId, resolvedOperator);
    }

    ConfigPublishEvent event = ConfigPublishEvent.instance();
    event.withAppId(release.getAppId()).withCluster(release.getClusterName())
        .withNamespace(release.getNamespaceName()).withPreviousReleaseId(releaseId)
        .setRollbackEvent(true).setEnv(Env.valueOf(env));
    publisher.publishEvent(event);
    return ResponseEntity.ok().build();
  }

  private NamespaceReleaseModel toReleaseModel(String appId, String env, String clusterName,
      String namespaceName, NamespaceReleaseDTO releaseDTO, String releasedBy) {

View on GitHub (pinned to d95fc18d11)

Solutions

1. Authenticate as an identity that has release permission on the namespace being rolled back (appId, env, cluster, namespace).
2. If calling via OpenAPI, use a consumer token or user token whose scope includes release permission for this namespace.
3. Have a super admin or app admin grant your user/token the release role for the namespace in the Apollo portal permission management page.

When it happens

Trigger: Thrown when an OpenAPI consumer or portal user calls the release endpoint without the required release permission for the target app/namespace, or when the access check in ReleaseController fails.

Common situations: A consumer token lacks release permission on the namespace; the operator resolved from the request is not authorized; missing or expired token.

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/6408509d79e44389. Report an issue: GitHub.