instructure/canvas-lms · error · GraphQL::ExecutionError

An object of type was hidden due to insufficient scopes on…

Error message

An object of type %{graphql_type} was hidden due to insufficient scopes on access token

What it means

Canvas GraphQL scopes limit what an access token can resolve. When a type is reached whose required scope the token lacks, unauthorized_object converts the GraphQL auth error into an ExecutionError saying the object was hidden due to insufficient scopes, so it never leaks existence.

Solutions

1. Regenerate the access token with the required scopes checked for the queried types.
2. Inspect the field/type definition to find the required scope and request it.
3. Test the query with an admin/full-scope token to confirm it is scope-related.

Example fix

// before
Authorization: Bearer <token with only read:courses>
// after (create token with required scopes)
Authorization: Bearer <token with read:courses, read:submissions>

const requiredScopes = ['url', ...] // scopes declared on queried types
if (!tokenScopes.includesAll(requiredScopes)) console.warn('token missing scopes:', requiredScopes.filter(s => !tokenScopes.includes(s)))

try { const data = await graphQL(query, token) } catch (e) { if (e.message.includes('hidden due to insufficient scopes')) { /* regenerate token with needed scopes */ } else throw e }

When it happens

Trigger: A GraphQL query resolving a field (e.g. submissions, grades) whose type requires a scope (e.g. url or a specific scope string) the developer's access token does not include.

Common situations: Personal access tokens created without the needed scopes; tokens minted for read:courses used on gradebook fields; queries that used to work before scopes were added to that type.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• and cannot be used together
• and cannot be used together
• A course with that id does not exist
• A maximum of 50 assessees can be provided at once
• A maximum of 50 assessors can be provided at once

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/12a3bc1ac266a733. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/canvas_schema.rb:125

        when "ExternalUrl" then Types::ExternalUrlType
        when "ContextExternalTool" then Types::ModuleExternalToolType
        end
      else
        Types::ModuleItemType
      end
    when ContextExternalTool then Types::ExternalToolType
    when InstitutionalTag            then Types::InstitutionalTagType
    when InstitutionalTagAssociation then Types::InstitutionalTagAssociationType
    when InstitutionalTagCategory    then Types::InstitutionalTagCategoryType
    when Setting then Types::InternalSettingType
    when AssessmentRequest then Types::AssessmentRequestType
    when UsageRights then Types::UsageRightsType
    when ScheduledPost then Types::ScheduledPostType
    end
  end

  def self.unauthorized_object(error)
    raise GraphQL::ExecutionError,
          I18n.t(
            "An object of type %{graphql_type} was hidden due to insufficient scopes on access token",
            graphql_type: error.type.graphql_name
          )
  end

  orphan_types [Types::PageType,
                Types::FileType,
                Types::ExternalUrlType,
                Types::ExternalToolType,
                Types::ModuleExternalToolType,
                Types::ProgressType,
                Types::ModuleSubHeaderType,
                Types::InternalSettingType]

  # GraphQL tuning and defensive settings
  query_analyzer(Analyzers::CanvasAntiabuseAnalyzer)
  query_analyzer(Analyzers::LogQueryComplexity)

View on GitHub (pinned to 1c9f0bb801)