Skip to content

Missing Permissions

Outcome: Understand SnapLink's "not found instead of forbidden" behavior, and what workspace roles control. Audience: Everyone / Admin · Tags: troubleshooting, permissions, workspace

Symptom: you get "not found" for something you're pretty sure exists

You have a flow ID, run ID, or link from a teammate, but loading it says not found — no flow, no run, nothing.

This is not a bug, and it's not a permission error either — it's deliberate. SnapLink scopes every resource to a workspace and checks your membership on every request. If a flow, run, connection, or draft exists in a workspace you're not a member of, SnapLink returns exactly the same 404 ...NOT_FOUND response it would return if the resource didn't exist at all. For this specific case — does this workspace/resource exist and am I in it — SnapLink never returns a 403 Forbidden that would confirm "yes, this exists, you just can't see it"; that confirmation itself is information an outsider shouldn't get. (There is one different situation where SnapLink does return a real 403 Forbidden — see the next section — but it never happens for "can I see this resource at all.")

Fix: 1. Confirm you're looking at the same workspace the resource lives in — check the workspace switcher in the app, or the workspaceId you're passing if you're calling the API directly. 2. If it's the right workspace and you still get 404, you're likely not a member of it yet — ask a workspace owner or admin to add you. 3. If you believe you are a member of the right workspace and still get 404, that's unexpected — see When to contact support below.

Symptom: "I can't add a member to my workspace"

Adding an existing user to a workspace requires the acting user to already be an owner or admin of that workspace — a plain member cannot add other members. This is the one place SnapLink does return a real 403 FORBIDDEN (not a 404): unlike the "can you see this resource" check above, here SnapLink already knows you're a legitimate member of the workspace — it's just enforcing that your role isn't high enough for this specific action, so there's no existence-leak risk in saying so plainly. You also can't assign the owner role through this action; a workspace has exactly one owner (its creator), and new members can only be added as admin or member.

Fix: Ask a current owner or admin of the workspace to add the person, specifying the role (admin or member) explicitly.

Workspace roles, honestly

SnapLink workspaces have three roles: owner, admin, and member.

  • Owner — automatically assigned to whoever creates the workspace. Exactly one per workspace; it can't be reassigned or removed via the membership API.
  • Admin and Member — everyone else. The one role difference that's currently enforced everywhere in the product is who can add or remove members: owners and admins can; plain members can't.

Beyond that specific check, SnapLink does not yet publish a granular, per-action permission matrix (e.g. "members can edit flows but not delete connections") — treat workspace membership itself as the primary access boundary today, and the owner/admin-only member-management rule as the one role-specific rule you can rely on. A more granular role system is not built yet; don't assume finer-grained restrictions exist beyond what's described here.

When to contact support

You're confident you're a member of the correct workspace and still get 404 on a resource you should be able to see, or you're an owner/admin and adding a member fails unexpectedly. Include the workspace name, the resource (flow/run) ID if applicable, and what you expected to see.

Related: Authentication errors · Administration · Security

Was this helpful? 👍 👎