payloadcms/payload · error · Forbidden

You are not allowed to perform this action.

Error message

You are not allowed to perform this action.

What it means

In `findDistinctOperation`, if the resolved field is `hidden` and the caller did not pass `showHiddenFields: true`, it throws `Forbidden`. Hidden fields are excluded from distinct queries unless explicitly requested with privilege.

Source

Thrown at packages/payload/src/collections/operations/findDistinct.ts:134

      where: where ?? {},
    })

    const fieldResult = getFieldByPath({
      config: payload.config,
      fields: collectionConfig.flattenedFields,
      includeRelationships: true,
      path: args.field,
    })

    if (!fieldResult) {
      throw new APIError(
        `Field ${args.field} was not found in the collection ${collectionConfig.slug}`,
        httpStatus.BAD_REQUEST,
      )
    }

    if (fieldResult.field.hidden && !showHiddenFields) {
      throw new Forbidden(req.t)
    }

    if (fieldResult.field.access?.read) {
      const hasAccess = await fieldResult.field.access.read({
        collection: collectionConfig,
        req,
      })
      if (!hasAccess) {
        throw new Forbidden(req.t)
      }
    }

    await validateSortQuery({
      collectionConfig,
      overrideAccess: overrideAccess!,
      req,
      sort: args.sort,
    })

View on GitHub (pinned to 00c58b35c0)

Solutions

  1. Pass `showHiddenFields: true` (and ensure the caller is privileged).
  2. Choose a non-hidden field for the distinct query.

Example fix

// before
await payload.findDistinct({ collection: 'posts', field: 'internalFlag' })
// after
await payload.findDistinct({ collection: 'posts', field: 'internalFlag', showHiddenFields: true, overrideAccess: true })
Defensive patterns

Strategy: validation

Validate before calling

function canQueryField(fieldConfig, showHiddenFields) {
  return !fieldConfig.hidden || showHiddenFields
}

Type guard

function isHiddenField(field): boolean {
  return !!field?.hidden
}

Try / catch

try {
  await payload.findDistinct({ collection, field })
} catch (e) {
  if (e?.statusCode === 403 || e?.name === 'Forbidden') notifyNoAccess()
  else throw e
}

Prevention

When it happens

Trigger: Running findDistinct on a field marked `hidden: true` in its field config, without `showHiddenFields: true`.

Common situations: Querying an internal/admin field that was marked hidden; admin tooling forgetting to pass `showHiddenFields`.

Related errors

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/49170da21473fc90. Report an issue: GitHub.