Resource not found error when running Workspaces.Read()

[hugodocto]

go-tfe version

1.71.0

Description

I'm developing a runtask that have to read the Terraform version in use in the workspace that triggered it.

I've written the following Go code snippet to achieve this (slightly modified for this post, we do not panic() in prod :)):

r := request.RunTaskRequest{}
err := json.Unmarshal([]byte(event.Body), &r)
if err != nil {
	panic(err)
}

// ...

c := &tfe.Config{
	Address:           "https://" + tfeDomain,
	Token:             r.AccessToken,
	RetryServerErrors: true,
}

client, err := tfe.NewClient(c)
if err != nil {
	fmt.Printf("cannot create new tfe client: %w\n", err)
}

w, err := client.Workspaces.Read(context.Background(), r.OrganizationName, r.WorkspaceName)
if err != nil {
	fmt.Printf("cannot read workspace: %w\n", err)
}

However, I'm encountering the error message:

cannot read workspace: resource not found

This indicates that client.Workspaces.Read() is failing, yet I'm certain the workspace exists. I've also tried client.Workspaces.ReadByID using r.WorkspaceID , but the issue persists. The error message "resource not found" is quite vague. Does anyone have suggestions on what might be causing this, or how to resolve it?

Expected Behavior

I expect it to work because both the organization and the workspace exist; but at least a better error message indicating what has not been found.

Actual Behavior

Resource not found error message.

Additional Context

I tried a few things:

• replaced the r.AccessToken value by a random string, and got a new error ('unauthorized'), so I think this isn't a token-related issue;
• tried both r.WorkspaceID and r.WorkspaceName as parameter in the client.Workspaces.ReadByID() function

[barrettclark]

@hugodocto I agree that this sounds like a token issue -- probably token permissions. Are you certain that the token you're using can read that workspace? To simplify the test case you could hit the API directly with the token you're using:

curl \
  --header "Authorization: Bearer $TFE_TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  "$TFE_ADDRESS/api/v2/organizations/$ORGANIZATION/workspaces/$WORKSPACE_NAME"

My theory is that the token does not have read access to the workspace, and we return a 404 as a result because you do not have access to see or know about the resource.

[barrettclark]

Closing. Feel free to reopen if you have more information to share.

[hugodocto]

Hey @barrettclark, thanks for your response! I did not manage to find time to investigate further the issue, but when I do I'll keep you posted here