HTTP 403, workspaces and membership

TENANT-007

Blocked by your organization's IP allowlist.

What it means

An administrator restricted this workspace to a set of networks, and the request did not come from one.

What to do

Connect from an allowed network. The setting refuses to save a list that would exclude the author's own address, so an administrator cannot lock the workspace out this way.

The response

Every failure arrives in this shape. The trace_id is worth keeping: it identifies the request in our logs and carries nothing about your data.

{
  "type": "https://shiftgraph.dev/errors/TENANT-007",
  "title": "Blocked by your organization's IP allowlist.",
  "status": 403,
  "code": "TENANT-007",
  "trace_id": "01J8Z…"
}

Related codes

Organizations, roles, invitations, and the org-level policies an administrator can set. A workspace you cannot see returns Not found rather than Forbidden, so that membership itself is never disclosed.

• TENANT-001Not found.HTTP 404
• TENANT-002This needs a higher role.HTTP 403
• TENANT-003That invitation is no longer valid.HTTP 400
• TENANT-004That slug is taken.HTTP 409
• TENANT-005An organization keeps at least one owner.HTTP 400
• TENANT-006Already a member of this organization.HTTP 409
• TENANT-008Your organization requires single sign-on.HTTP 403
• TENANT-009A digest needs at least one connected dependency.HTTP 400

The full error reference, or write to support@shiftgraph.dev with the trace id.