access_denied

What happened

You don’t have permission to do this. Ask an administrator if you need access.

Technical background

AccessDeniedError (HTTP 403) is the generic permission failure. The dispatcher raises it when the handler’s access rule does not match the caller’s roles, when a row or team scope hides the target record, and when a feature denies a cross-tenant call. Handlers throw it for their own checks too.

When a more specific reason applies, the error carries it in details.reason and docsUrl points at that page instead, for example field_access_denied or tenant_override_requires_system_admin. A missing sign-in is unauthenticated (401), a globally disabled feature is feature_disabled.

Handlers are default-deny: a handler without a matching rule refuses every caller. See the access-control example and Auth.

Tip

Error code: access_denied · Class: AccessDeniedError · HTTP: 403