permission_error

HTTP 403. Authentication succeeded; authorisation did not.

403 — account paused

{
  "error": {
    "type": "permission_error",
    "message": "Account is suspended. Renders are paused.",
    "docs_url": "https://galleyrender.com/docs/errors/permission_error",
    "details": { "status": "suspended" }
  }
}

403 — expired signed link

{
  "error": {
    "type": "permission_error",
    "message": "This link is invalid or has expired. Request a fresh URL for the render.",
    "docs_url": "https://galleyrender.com/docs/errors/permission_error"
  }
}

Why this happens

Two raise sites:

• The account is not active. Checked before every render, ahead of any quota. details.status gives the state — suspended, closed, or whatever else it has been set to. Every render fails this way until the account is active again.
• A signed file link failed verification. On deployments serving files through /v1/files/* — local development and self-hosted installs — this is returned when the signature is wrong or the expires timestamp has passed. In production, R2 rejects an expired presigned URL itself, with its own XML error rather than this envelope.

Note what does not produce a 403: another account’s render or template is a not_found, never a 403 with a hint.

How to fix it

For a paused account, contact support@galleyrender.com — renders stay blocked until the status is cleared, and nothing you send will change that. For an expired link, call GET /v1/renders/:id, which signs a fresh URL every time and never re-renders. Signed URLs last an hour; the stored object lasts far longer.

Does retrying help?

No for a suspended account. For a link, yes — but only after re-signing it.