usestrix/strix · error · RelayError

forbidden

forbidden

Error message

forbidden

What it means

RelayError('forbidden') raised by report_send() when POST /api/oss/report/send returns 403. Unlike 401 (reverify), 403 means the token is valid but the account is not permitted to use report delivery — the operation is intentionally denied, not merely unauthenticated.

Source

Thrown at strix/interface/viewer/auth.py:247

    The report password is NEVER part of this payload; only the encrypted PDF
    bytes travel to the relay.
    """
    payload = {
        "token": token,
        "pdf_base64": base64.b64encode(pdf_bytes).decode("ascii"),
        "filename": filename,
        "run_name": run_name,
        "target": target,
    }
    status, _ = _post_json("/api/oss/report/send", payload, timeout=_SEND_TIMEOUT)
    if status == 200:
        return
    if status == 401:
        raise RelayError("reverify")
    if status == 413:
        raise RelayError("too_large")
    if status == 403:
        raise RelayError("forbidden")
    raise RelayError("unavailable")


__all__ = [
    "AUTH_PATH",
    "RelayError",
    "feedback_submit",
    "forget",
    "is_verified",
    "otp_start",
    "otp_verify",
    "read_auth",
    "report_send",
    "write_auth",
]

View on GitHub (pinned to 8551339130)

Solutions

  1. Confirm report sending is available to your verification tier; if gated, use local PDF download/export instead
  2. Re-verify with a qualifying work email (see work_email_required) in case entitlement is tied to verification type
  3. Check Strix docs/changelog for announced restrictions on the OSS report relay
  4. If it seems like a mistake, report it via feedback_submit with run details
Defensive patterns

Strategy: try-catch

Validate before calling

# No reliable client-side pre-check: 403 is a relay-side entitlement decision.
# Guard by offering local export as the always-available path.
def send_report_or_export(pdf, filename):
    try:
        report_send(token, pdf, filename, run, target)
        return "sent"
    except RelayError:
        save_pdf_locally(pdf, filename)
        return "exported-locally"

Try / catch

try:
    report_send(token, pdf, filename, run, target)
except RelayError as e:
    if e.code == "forbidden":
        show("Report delivery is not available for this account; exporting locally instead.")
        save_pdf_locally(pdf, filename)
    else:
        raise

Prevention

When it happens

Trigger: Calling report_send() with a valid, unexpired token whose verification does not carry the entitlement for report sending (e.g. tier/feature gating on the relay side), or an account type the relay restricts. The 403 maps to 'forbidden' distinct from the 401 'reverify' path.

Common situations: Relay-side feature gating (report delivery limited to certain verified cohorts); policy change on app.strix.ai after the user last verified; trying to use the send endpoint from an environment or region the relay blocks.

Understand the failure class

Related errors

AI-assisted analysis of usestrix/strix@8551339130 (2026-08-15). Data as JSON: /api/errors/93bfd92d726c6073. Report an issue: GitHub.