flarum/framework · error · ForbiddenException

ForbiddenException

Error message

ForbiddenException

What it means

Authorization guard in Endpoint::handle: after resolving the model (via findResource when a model id is present), the endpoint runs isVisible($context); it fires when the authenticated actor fails the endpoint's visibility/authorization checks, so the action is denied with a 403-class ForbiddenException. Generic guard — the input at fault is the actor's lack of permission for the targeted model.

Solutions

1. Grant the actor the required permission/policy for the resource (check the model's visibility scoping and the group permissions).
2. Confirm the correct actor/session is being used for the request.
3. If the denial is unexpected, inspect the endpoint's isVisible/authorize logic and the resource's visibility scopes.
4. Handle 403 on the client by hiding or disabling the action.

When it happens

Trigger: Thrown at framework/core/src/Api/Endpoint/Endpoint.php:134 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/8eb68ee0c0b920a8. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Api/Endpoint/Endpoint.php:134

        if (strtolower($context->method()) !== strtolower($this->method)) {
            throw new MethodNotAllowedException();
        }

        /** @var AbstractResource $collection */
        $collection = $context->collection;

        $context = $context->withModelId(
            $collection->id($context)
        );

        if ($context->modelId) {
            $context = $context->withModel(
                $this->findResource($context, $context->modelId)
            );
        }

        if (! $this->isVisible($context)) {
            throw new ForbiddenException();
        }

        $data = $this->process($context);

        foreach ($this->beforeSerialization as $callback) {
            $callback($context, $data);
        }

        if ($this->response) {
            return ($this->response)($context, $data);
        }

        if ($context->model && $data instanceof $context->model) {
            return json_api_response($this->showResource($context, $data));
        }

        if (is_array($data)) {
            return json_api_response($data);

View on GitHub (pinned to 4b939f6853)