Errors
403 - token valid but for a different instance
What happened
The credential is recognized but does not authorize this action on the requested resource.
- Check the identityConfirm the account and target instance.
- Review the required permissionCompare the operation with the granted access.
- Ask an administratorCorrect the intended grant or target.
- Verify the allowed operationRetry only after the access issue is resolved.
Request that triggers it
A token for tenant A used against tenant B's URL.
curl -X POST "https://$OC_HOST/v1/tenants/other-tenant/sql" \
-H "Authorization: Bearer $OC_TOKEN" \
-H "Content-Type: application/json" \
-d '{"sql": "SELECT id FROM shop.products LIMIT 1"}'Read the response
{
"error": "forbidden",
"message": "token does not authorise access to tenant 'other-tenant'",
"retry": false
}Fix the request
- Check that the credential belongs to the intended instance and identity.
- Inspect the permissions required for this operation.
- Ask an authorized administrator to correct the grant if appropriate.
- Retry after the permission change.
Keep in mind: Changing tokens at random or repeating the same request does not resolve the missing permission.
Common causes
- Tenant id hardcoded in a snippet that was copied between environments.
- Staging token used against a production endpoint.
- Tenant id and instance hostname out of sync after a rename.
- Multi-tenant app router building the URL from one source and the token from another.
- Token scope was narrowed (e.g. read-only) and the call needs a permission the scope doesn't grant.
Continue
See error handling and retries, or return to error examples.