phacility/phabricator · error · ConduitException

You do not have access to the application which provides thi

Error message

You do not have access to the application which provides this API method.

What it means

After authentication succeeds, ConduitCall runs the calling user through PhabricatorPolicyFilter against PhabricatorPolicyCapability::CAN_VIEW on the application that owns the method. If the user cannot view that application (e.g. it is restricted to an admin-only policy), the call is rejected — a policy/authorization denial, not a missing-credential problem like ERR-INVALID-AUTH.

Source

Thrown at src/applications/conduit/call/ConduitCall.php:123

      if (!$allow_public) {
        if (!$user->isLoggedIn() && !$user->isOmnipotent()) {
          // TODO: As per below, this should get centralized and cleaned up.
          throw new ConduitException('ERR-INVALID-AUTH');
        }
      }

      // TODO: This would be slightly cleaner by just using a Query, but the
      // Conduit auth workflow requires the Call and User be built separately.
      // Just do it this way for the moment.
      $application = $this->handler->getApplication();
      if ($application) {
        $can_view = PhabricatorPolicyFilter::hasCapability(
          $user,
          $application,
          PhabricatorPolicyCapability::CAN_VIEW);

        if (!$can_view) {
          throw new ConduitException(
            pht(
              'You do not have access to the application which provides this '.
              'API method.'));
        }
      }
    }

    return $this->handler->executeMethod($this->request);
  }

  protected function buildMethodHandler($method_name) {
    $method = ConduitAPIMethod::getConduitMethod($method_name);

    if (!$method) {
      throw new ConduitMethodDoesNotExistException($method_name);
    }

    $application = $method->getApplication();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Grant the user (or the token owner) view access: adjust the application's policy in Applications -> <app> -> Edit Policies, or add the user to the allowed project
2. Use a token owned by a user/bot that already has view access to that application
3. Verify access programmatically with PhabricatorPolicyFilter::hasCapability($user, $app, PhabricatorPolicyCapability::CAN_VIEW) before making the call

Example fix

// before
$user = id(new PhabricatorPeopleQuery())
  ->setViewer($admin)
  ->withUsernames(array('ci-bot'))
  ->executeOne();
$response = id(new ConduitCall('differential.revision.query', array()))
  ->setUser($user)
  ->execute();

// after: check capability first, surface a clear message
$application = PhabricatorApplication::getByClass('DifferentialApplication');
if (!PhabricatorPolicyFilter::hasCapability(
      $user, $application, PhabricatorPolicyCapability::CAN_VIEW)) {
  throw new Exception('Grant ci-bot view access to Differential.');
}
$response = id(new ConduitCall('differential.revision.query', array()))
  ->setUser($user)
  ->execute();

$application = PhabricatorApplication::getByClass($app_class);
if (!PhabricatorPolicyFilter::hasCapability(
      $viewer, $application, PhabricatorPolicyCapability::CAN_VIEW)) {
  throw new Exception(
    pht('User %s cannot view application %s.',
      $viewer->getUsername(), $application->getName()));
}
$response = id(new ConduitCall($method, $params))
  ->setUser($viewer)
  ->execute();

try {
  $result = id(new ConduitCall($method, $params))->setUser($viewer)->execute();
} catch (ConduitException $ex) {
  if (strpos($ex->getMessage(), 'do not have access to the application') !== false) {
    // Authorization problem: report which application policy blocked the user.
  }
  throw $ex;
}

When it happens

Trigger: A normal user (or a bot token whose owner lacks rights) calling a method provided by an application whose view policy excludes them — e.g. a Policies-restricted 'Differential' application and a differential.revision.query call; A newly installed application that defaults to administrator-only policies; A daemon/script using a token belonging to a user who was demoted or removed from the required project

Common situations: Hardening passes that lock application policies down to admins, silently breaking bot integrations; per-user API tokens inheriting their owner's policy visibility; new hires calling tools before being granted access to the relevant applications.

Related errors

• Service "%s" is unrecognized, restricted, or you do not have
• Service type "%s" is unrecognized. Valid types are: %s.
• Transaction value when deleting Almanac properties must be a
• When deleting Almanac properties, each property name must be
• Transaction value when setting Almanac properties must be a

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/811e0d5e7f0b1d98. Report an issue: GitHub.