apolloconfig/apollo · error · AccessDeniedException

Delete namespace permission is required

Error message

Delete namespace permission is required

What it means

HTTP 403 (AccessDeniedException). Thrown by NamespaceController.requireDeleteNamespacePermissionForUserToken: auth type USER_TOKEN and UnifiedPermissionValidator.hasDeleteNamespacePermission(appId,env,cluster,namespace) is false. The user-token lacks the delete-namespace permission needed to remove a namespace.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceController.java:396

          namespace.getClusterName(), namespace.getAppNamespaceName());
    }
  }

  private void requireCreateNamespacePermissionForUserToken(String appId, String env,
      String clusterName, String namespaceName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasCreateNamespacePermission(appId, env, clusterName,
            namespaceName)) {
      throw new AccessDeniedException("Create namespace permission is required");
    }
  }

  private void requireDeleteNamespacePermissionForUserToken(String appId, String env,
      String clusterName, String namespaceName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasDeleteNamespacePermission(appId, env, clusterName,
            namespaceName)) {
      throw new AccessDeniedException("Delete namespace permission is required");
    }
  }

  private String resolveOperator(String queryOperator, String payloadOperator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      String operator = StringUtils.isBlank(queryOperator) ? payloadOperator : queryOperator;
      RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),
          "operator should not be null or empty");

View on GitHub (pinned to d95fc18d11)

Solutions

1. Grant the user-token owner DeleteNamespace permission on the target appId/env/cluster/namespace.
2. Use a portal USER that holds delete-namespace rights or a CONSUMER token scoped for deletion.
3. Confirm deletion is intended; namespaces under released configs are protected.
4. Pre-check hasDeleteNamespacePermission before issuing DELETE.

Example fix

// before: user-token owner lacks DeleteNamespace
client.withUserToken(token).deleteNamespace("appX", env, cluster, ns); // 403

// after: grant delete-namespace then retry
admin.grantDeleteNamespace("appX", env, cluster, ns, token.getOwnerId());
client.withUserToken(token).deleteNamespace("appX", env, cluster, ns);

// For USER_TOKEN namespace delete: confirm DeleteNamespace permission.
if (!hasDeleteNamespace(tokenOwner, appId, env, cluster, ns)) {
  // grant DeleteNamespace or skip; do not call deleteNamespace
}

null

try {
  client.withUserToken(token).deleteNamespace(appId, env, cluster, ns);
} catch (HttpServerErrorException.Forbidden e) {
  // Delete namespace permission is required -> grant and retry
}

When it happens

Trigger: DELETE namespace on NamespaceController using a user-token whose owner lacks DeleteNamespace role on the target appId/env/cluster/namespace.

Common situations: User-token has modify/create but not delete rights (delete is typically the most restricted); namespace deletion attempted by a CI token scoped to config edits; role narrowed after automation was written.

Related errors

• Access is denied
• Create namespace permission is required
• You don't have the permission to modify namespace: %s
• Access is denied
• Metadata read permission is required

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/bf2993faafdc4249. Report an issue: GitHub.