mastra-ai/mastra · warning · HTTPException

You do not have permission to view usage for this connection

Error message

You do not have permission to view usage for this connection

What it means

A 403 fail-closed guard on the connection usage endpoint: when storage is configured but no row matches the requested connectionId, non-admin callers are refused so they cannot probe for other tenants' connection IDs. Distinguishes 'no permission' from 'not found' to avoid leaking existence.

Source

Thrown at packages/server/src/server/handlers/tool-providers.ts:765

      const store = await storage?.getStore('toolProviderConnections');
      let ownerAuthorId: string | undefined;
      let ownerScope: 'shared' | 'per-author' | 'caller-supplied' | undefined;
      let matched = false;
      if (store) {
        const rows = await store.listConnectionsByAuthor({ providerId: provider.info.id });
        const match = rows.find(r => r.connectionId === connectionId);
        if (match) {
          matched = true;
          ownerAuthorId = match.authorId;
          ownerScope = match.scope;
        }
      }

      // Fail closed: if storage is configured and no row matches the
      // requested connectionId, refuse the call for non-admins so callers
      // cannot probe for other tenants' connections.
      if (store && !matched && !isAdmin) {
        throw new HTTPException(403, {
          message: 'You do not have permission to view usage for this connection',
        });
      }

      const effectiveOwner = ownerAuthorId ?? callerAuthorId;
      const isShared = ownerScope === 'shared';
      if (!isShared && effectiveOwner !== callerAuthorId && !isAdmin) {
        throw new HTTPException(403, {
          message: 'You do not have permission to view usage for this connection',
        });
      }

      const agents = await scanConnectionUsage(mastra, { providerId: provider.info.id, connectionId, toolkit });
      return { agents };
    } catch (error) {
      return handleError(error, 'Error listing tool provider connection usage');
    }
  },

View on GitHub (pinned to 75dd419e61)

Solutions

1. Verify the connectionId exists and belongs to you (list your connections first).
2. Re-authenticate as the connection's author, or use an admin context.
3. If the connection was deleted, recreate it before checking usage.

Example fix

// before
await api.get(`/api/tool-providers/github/connections/${someoneElsesId}/usage`); // 403
// after: discover your own connection IDs first
const list = await api.get(`/api/tool-providers/github/connections`);
const mine = list.connections.find(c => c.label === 'mine');
await api.get(`/api/tool-providers/github/connections/${mine.connectionId}/usage`);

const list = await api.get(`/api/tool-providers/${providerId}/connections`);
if (!list.connections.some(c => c.connectionId === id)) {
  throw new Error('Connection does not exist or is not visible to you');
}

try {
  return await api.get(`/api/tool-providers/${p}/connections/${id}/usage`);
} catch (e) {
  if (e.status === 403) return { agents: [], restricted: true };
  throw e;
}

When it happens

Trigger: Calling the connection usage endpoint with a connectionId that has no matching row for the caller (e.g. another tenant's connection or a nonexistent ID) while not an admin — even though a 404 would seem more apt, the handler intentionally returns 403.

Common situations: Enumerating/guessing connection IDs across tenants; querying usage for a deleted connection as a non-admin; querying a connection scoped to another author.

Related errors

• You do not have permission to disconnect this connection
• Access denied: durable run belongs to a different resource
• Access denied: cannot save messages for a different resource
• Access denied: unable to verify message ownership
• Cannot authorize caller-supplied connection: request context

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/4fb22afb0374ac27. Report an issue: GitHub.