gRPC status 7: PERMISSION_DENIED
PERMISSION_DENIED is gRPC status code 7. The caller is identified but not allowed to do this.
Updated
Usual causes
- The credentials are valid but lack the role or scope this method needs.
- A token for the right user but the wrong project, tenant or audience.
- A policy in a proxy or service mesh, not the service itself, rejected the call.
What to check
- Which identity the server saw: the token's subject, scopes and audience.
- The role or permission the method requires, from the service's documentation.
- Mesh or gateway authorisation policies between you and the service.
Not to be confused with
Missing or invalid credentials are UNAUTHENTICATED; PERMISSION_DENIED means they were accepted and the answer is no.
What it looks like
A typical error, as a Go client prints it: rpc error: code = PermissionDenied desc = caller lacks orders.write on project 7
Retry, and the HTTP equivalent
| PERMISSION_DENIED | |
|---|---|
| Code | 7 |
| Name | PERMISSION_DENIED |
| In istek's status bar | permission_denied |
| Retry | No; the same credentials get the same answer. |
| HTTP status | 403 |
istek names the status of every call it makes, permission_denied included, and explains transport failures in plain words. See istek.