weaviate/weaviate · error · Error

unauthorized to access collection %s

Error message

unauthorized to access collection %s

What it means

Query authorizes the resolved collection via the RBAC filter; when the filter drops the only query input, the manager knows the principal lacks READ on that collection and returns this 403 error. It is the list-objects endpoint's way of saying the authenticated user/role is not allowed to read the requested collection.

Source

Thrown at usecases/objects/query.go:104

	m.metrics.GetObjectInc()
	defer m.metrics.GetObjectDec()

	q, err := params.inputs(m)
	if err != nil {
		return nil, &Error{"offset or limit", StatusBadRequest, err}
	}

	filteredQuery := filter.New[*QueryInput](m.authorizer, m.config.Config.Authorization.Rbac).Filter(
		ctx,
		principal,
		[]*QueryInput{q},
		authorization.READ,
		func(qi *QueryInput) string {
			return authorization.CollectionsData(qi.Class)[0]
		},
	)
	if len(filteredQuery) == 0 {
		err = fmt.Errorf("unauthorized to access collection %s", q.Class)
		return nil, &Error{err.Error(), StatusForbidden, err}
	}

	res, rerr := m.vectorRepo.Query(ctx, filteredQuery[0])
	if rerr != nil {
		return nil, rerr
	}

	if m.modulesProvider != nil {
		res, err = m.modulesProvider.ListObjectsAdditionalExtend(ctx, res, q.Additional.ModuleParams)
		if err != nil {
			return nil, &Error{"extend results", StatusInternalServerError, err}
		}
	}

	if q.Additional.Vector {
		m.trackUsageList(res)
	}

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Grant the principal's role READ on the collection: add the collection to the role's collections-data permissions
2. Verify which user/key the request authenticates as (check logs/Authorization header)
3. Inspect current permissions with the roles API and compare against the queried class name
4. If a wildcard listing is intended, ensure the user has read rights on all collections or scope the query to allowed ones

// check permissions before listing
allowed, err := authz.HasCollectionsDataRead(ctx, principal, className)
if err != nil || !allowed {
    return fmt.Errorf("no READ permission on %s", className)
}

func canRead(principal *models.Principal, class string) bool {
    return principal != nil && roleGrantsRead(principal.Roles, class)
}

if err != nil {
    var e *objects.Error
    if errors.As(err, &e) && e.StatusCode == 403 {
        // surface which collection was denied; do not retry
    }
}

When it happens

Trigger: GET /v1/objects?class=Article (list objects) where the principal's roles grant no READ on "Article"; listing with class "*" but filtered out to an empty set for a restricted user; querying a qualified namespace class the principal cannot read.

Common situations: RBAC misconfiguration after migrating to role-based auth; API key or OIDC user mapped to a role without collections-data read; forgetting to add read permissions after creating a new collection.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• assigning: %w
• due to GraphQL introspection, this role must have the permis
• adminlist: %w
• failed to get class: %s: %w
• insufficient permissions to view role

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/f1a921e4b006b996. Report an issue: GitHub.