hasura/graphql-engine · error · PermissionError::ObjectTypeNotAccessible

no permission to select from type {object_type_name:}

Error message

no permission to select from type {object_type_name:}

What it means

PermissionError::ObjectTypeNotAccessible is thrown when the role has no permission to select the named object type (a custom/structured type). Permission evaluation for the type-level selection fails, blocking queries that return that object type.

Source

Thrown at v3/crates/plan/src/types.rs:74

        command_name: Qualified<CommandName>,
    },
    #[error("no permission to select from command {command_name:}")]
    CommandNotAccessible {
        command_name: Qualified<CommandName>,
    },
    #[error("model {model_name:} could not be found")]
    ModelNotFound { model_name: Qualified<ModelName> },
    #[error("model {model_name:} has no source")]
    ModelHasNoSource { model_name: Qualified<ModelName> },

    #[error("no permission to select from model {model_name:}")]
    ModelNotAccessible { model_name: Qualified<ModelName> },

    #[error("object type {object_type_name:} could not be found")]
    ObjectTypeNotFound {
        object_type_name: Qualified<CustomTypeName>,
    },
    #[error("no permission to select from type {object_type_name:}")]
    ObjectTypeNotAccessible {
        object_type_name: Qualified<CustomTypeName>,
    },
    #[error("no permission to select from field {field_name:} in type {object_type_name:}")]
    ObjectFieldNotFound {
        object_type_name: Qualified<CustomTypeName>,
        field_name: FieldName,
    },
    #[error("Object boolean expression type {boolean_expression_type_name} could not be found")]
    ObjectBooleanExpressionTypeNotFound {
        boolean_expression_type_name: Qualified<CustomTypeName>,
    },
    #[error("Relationship {relationship_name} not found for object type {object_type_name}")]
    RelationshipNotFound {
        object_type_name: Qualified<CustomTypeName>,
        relationship_name: RelationshipName,
    },
    #[error(

View on GitHub (pinned to 724551b9ae)

Solutions

1. Add select permission for the object type for the requesting role
2. Ensure every role that can query models returning this type also has permission on the type itself
3. Verify role names between session variables and metadata
4. Re-run metadata consistency checks/apply after permission edits

Example fix

// before
// object type "Address": no permissions for role "user"
// after
object_type_permissions: [ { type: "Address", role: "user", actions: ["select"] } ]

fn can_select_type(perms: &[TypePermission], role: &str, ty: &str) -> bool {
    perms.iter().any(|p| p.type_name == ty && p.role == role)
}

Match PermissionError::ObjectTypeNotAccessible and map to a 403 authorization response naming the object type for admins only.

When it happens

Trigger: Selecting fields of an object type (or a model whose output type is that object type) under a role that has no type-level select permission granted for the object type in metadata.

Common situations: Custom object types added without type permissions for non-admin roles; roles granted model permissions but missing the accompanying object-type permission; role name mismatches; metadata migrations dropping type permissions.

Related errors

• no permission to select from command {command_name:}
• no permission to select from model {model_name:}
• Condition {condition_hash} not found
• Expected array or null for right-hand value of contains oper
• Expected number for {side}-hand value of comparison operatio

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/d14b26fe3038053f. Report an issue: GitHub.