mastra-ai/mastra · warning · HTTPException

You do not have permission to view usage for this connection

Error message

You do not have permission to view usage for this connection

What it means

A 403 fail-closed guard on the connection usage endpoint: when storage is configured but no row matches the requested connectionId, non-admin callers are refused so they cannot probe for other tenants' connection IDs. Distinguishes 'no permission' from 'not found' to avoid leaking existence.

Solutions

1. Verify the connectionId exists and belongs to you (list your connections first).
2. Re-authenticate as the connection's author, or use an admin context.
3. If the connection was deleted, recreate it before checking usage.

Example fix

// before
await api.get(`/api/tool-providers/github/connections/${someoneElsesId}/usage`); // 403
// after: discover your own connection IDs first
const list = await api.get(`/api/tool-providers/github/connections`);
const mine = list.connections.find(c => c.label === 'mine');
await api.get(`/api/tool-providers/github/connections/${mine.connectionId}/usage`);

const list = await api.get(`/api/tool-providers/${providerId}/connections`);
if (!list.connections.some(c => c.connectionId === id)) {
  throw new Error('Connection does not exist or is not visible to you');
}

try {
  return await api.get(`/api/tool-providers/${p}/connections/${id}/usage`);
} catch (e) {
  if (e.status === 403) return { agents: [], restricted: true };
  throw e;
}

When it happens

Trigger: Calling the connection usage endpoint with a connectionId that has no matching row for the caller (e.g. another tenant's connection or a nonexistent ID) while not an admin — even though a 404 would seem more apt, the handler intentionally returns 403.

Common situations: Enumerating/guessing connection IDs across tenants; querying usage for a deleted connection as a non-admin; querying a connection scoped to another author.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• You do not have permission to disconnect this connection
• Access denied: cannot save messages for a different resource
• Access denied: durable run belongs to a different resource
• Access denied: thread belongs to a different resource
• Access denied: unable to verify message ownership

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/4fb22afb0374ac27. Report an issue: GitHub.

Appendix: source

Thrown at packages/server/src/server/handlers/tool-providers.ts:765

      const store = await storage?.getStore('toolProviderConnections');
      let ownerAuthorId: string | undefined;
      let ownerScope: 'shared' | 'per-author' | 'caller-supplied' | undefined;
      let matched = false;
      if (store) {
        const rows = await store.listConnectionsByAuthor({ providerId: provider.info.id });
        const match = rows.find(r => r.connectionId === connectionId);
        if (match) {
          matched = true;
          ownerAuthorId = match.authorId;
          ownerScope = match.scope;
        }
      }

      // Fail closed: if storage is configured and no row matches the
      // requested connectionId, refuse the call for non-admins so callers
      // cannot probe for other tenants' connections.
      if (store && !matched && !isAdmin) {
        throw new HTTPException(403, {
          message: 'You do not have permission to view usage for this connection',
        });
      }

      const effectiveOwner = ownerAuthorId ?? callerAuthorId;
      const isShared = ownerScope === 'shared';
      if (!isShared && effectiveOwner !== callerAuthorId && !isAdmin) {
        throw new HTTPException(403, {
          message: 'You do not have permission to view usage for this connection',
        });
      }

      const agents = await scanConnectionUsage(mastra, { providerId: provider.info.id, connectionId, toolkit });
      return { agents };
    } catch (error) {
      return handleError(error, 'Error listing tool provider connection usage');
    }
  },

View on GitHub (pinned to 75dd419e61)