apolloconfig/apollo · warning · AccessDeniedException

Access is denied

Error message

Access is denied

What it means

AccessDeniedException (HTTP 403) from ReleaseController.get (GET /envs/{env}/releases/{releaseId}). After loading the release, if unifiedPermissionValidator.shouldHideConfigToCurrentUser(...) is true for the release's appId/env/cluster/namespace, the config is hidden and access is denied with this generic message (no details leaked).

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/ReleaseController.java:140

    ConfigPublishEvent event = ConfigPublishEvent.instance();
    event.withAppId(appId).withCluster(clusterName).withNamespace(namespaceName)
        .withReleaseId(createdRelease.getId()).setGrayPublishEvent(true).setEnv(Env.valueOf(env));

    publisher.publishEvent(event);

    return createdRelease;
  }

  @GetMapping("/envs/{env}/releases/{releaseId}")
  public ReleaseDTO get(@PathVariable String env, @PathVariable long releaseId) {
    ReleaseDTO release = releaseService.findReleaseById(Env.valueOf(env), releaseId);

    if (release == null) {
      throw NotFoundException.releaseNotFound(releaseId);
    }
    if (unifiedPermissionValidator.shouldHideConfigToCurrentUser(release.getAppId(), env,
        release.getClusterName(), release.getNamespaceName())) {
      throw new AccessDeniedException("Access is denied");
    }
    return release;
  }

  @GetMapping(
      value = "/apps/{appId}/envs/{env}/clusters/{clusterName}/namespaces/{namespaceName}/releases/all")
  public List<ReleaseBO> findAllReleases(@PathVariable String appId, @PathVariable String env,
      @PathVariable String clusterName, @PathVariable String namespaceName,
      @Valid @PositiveOrZero(message = "page should be positive or 0")
      @RequestParam(defaultValue = "0") int page,
      @Valid @Positive(message = "size should be positive number")
      @RequestParam(defaultValue = "5") int size) {
    if (unifiedPermissionValidator.shouldHideConfigToCurrentUser(appId, env, clusterName,
        namespaceName)) {
      return Collections.emptyList();
    }

    return releaseService.findAllReleases(appId, Env.valueOf(env), clusterName, namespaceName, page,

View on GitHub (pinned to d95fc18d11)

Solutions

1. Request view-config permission on the release's appId/env/cluster/namespace.
2. Confirm the releaseId belongs to a namespace you are authorized to see.
3. Use an account that holds the appropriate role for that app.
4. If unexpected, audit the role assignments and the shouldHideConfigToCurrentUser rule.

Example fix

// No code fix: authorization gate. Gain view-config permission on the target namespace, or query a release you are authorized to read.

// Reading a release can 403 when config is hidden from the current user.
try {
  ReleaseDTO r = portal.getRelease(env, releaseId);
} catch (HttpClientErrorException.Forbidden e) {
  // 'Access is denied' - user lacks view-config permission on that namespace
  requestViewConfigPermission(r_appId, r_namespace); // from a prior allowed lookup
}

When it happens

Trigger: GET /envs/{env}/releases/{releaseId} by a user who is permitted to authenticate but is not allowed to view that namespace's config (role-based config visibility hides it).

Common situations: A user belonging to an app but without view-config rights on a restricted namespace; cross-team visibility rules; a service account without the view role.

Related errors

• Forbidden operation. Caused by: 1.you don't have release per
• Forbidden operation. Caused by: 1.you don't have release per
• Assign role permission is required
• You don't have the permission to modify namespace: %s
• You don't have the permission to modify namespace: %s

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/688938e78b97e058. Report an issue: GitHub.