What does the VARTA error `tenant_forbidden` mean?

HTTP status: 403  ·  Type: permission_error

What it means

The catalogue reserves this code for a resource that exists but belongs to another tenant.

What causes it

Cause not yet documented as a live path — by design, this platform does not raise it. Cross-tenant access is deliberately made indistinguishable from a missing resource (backend/app/security/ownership.py, backend/app/api/v1/errors.py), so a cross-tenant id returns not_found instead, precisely so the distinction can't be used to enumerate ids.

That substitution — and the cross-tenant rejection behind it — applies in enforce mode. On a default instance auth_mode is "audit" (backend/app/core/config.py:26), and require_tenant returns the resource without comparing tenants at all (backend/app/security/ownership.py:51-52): a cross-tenant id is neither rejected as tenant_forbidden nor masked as not_found, it simply succeeds. Object-level isolation is observed but not enforced there. See Authentication.

What to do

Treat not_found on an id you expect to exist as covering this case: you're most likely calling it with the wrong tenant's id.