[SalesForce] 403:denied_by_security_policy:create_denied when subscribing to platform events

This error is thrown when I try to subscribe to a platform event using the EMP-connector. I followed the steps outlined in the documentation:

https://developer.salesforce.com/docs/atlas.en-us.220.0.platform_events.meta/platform_events/code_sample_java_add_source.htm

https://developer.salesforce.com/docs/atlas.en-us.220.0.platform_events.meta/platform_events/code_sample_subscribe_custom_events.htm

and get:

    Exception in thread "main" java.util.concurrent.ExecutionException: com.salesforce.emp.connector.CannotSubscribe: Unable to subscribe to [/event/Low_InkA__e:-2] [https://xxxxxxxx.salesforce.com/cometd/39.0] : 403:denied_by_security_policy:create_denied
    at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:357)
    at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1915)
    at com.salesforce.emp.connector.example.LoginExample.main(LoginExample.java:74)
Caused by: com.salesforce.emp.connector.CannotSubscribe: Unable to subscribe to [/event/Low_InkA__e:-2] [https://xxxxxx.salesforce.com/cometd/39.0] : 403:denied_by_security_policy:create_denied
    at com.salesforce.emp.connector.EmpConnector$SubscriptionImpl.lambda$subscribe$1(EmpConnector.java:94)
    at org.cometd.common.AbstractClientSession$AbstractSessionChannel.notifyOnMessage(AbstractClientSession.java:598)
    at org.cometd.common.AbstractClientSession.notifyListener(AbstractClientSession.java:314)
    at org.cometd.common.AbstractClientSession.notifyListeners(AbstractClientSession.java:289)
    at org.cometd.common.AbstractClientSession.receive(AbstractClientSession.java:261)
    at org.cometd.client.BayeuxClient.processMessage(BayeuxClient.java:821)
    at org.cometd.client.BayeuxClient.processMessages(BayeuxClient.java:617)
    at org.cometd.client.BayeuxClient.access$3100(BayeuxClient.java:100)
    at org.cometd.client.BayeuxClient$MessageTransportListener.onMessages(BayeuxClient.java:1186)
    at org.cometd.client.transport.LongPollingTransport$2.onComplete(LongPollingTransport.java:232)
    at org.eclipse.jetty.client.ResponseNotifier.notifyComplete(ResponseNotifier.java:193)
    at org.eclipse.jetty.client.ResponseNotifier.notifyComplete(ResponseNotifier.java:185)
    at org.eclipse.jetty.client.HttpReceiver.terminateResponse(HttpReceiver.java:454)
    at org.eclipse.jetty.client.HttpReceiver.responseSuccess(HttpReceiver.java:401)
    at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.messageComplete(HttpReceiverOverHTTP.java:266)
    at org.eclipse.jetty.http.HttpParser.parseContent(HttpParser.java:1403)
    at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:1245)
    at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.parse(HttpReceiverOverHTTP.java:156)
    at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.process(HttpReceiverOverHTTP.java:117)
    at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.receive(HttpReceiverOverHTTP.java:69)
    at org.eclipse.jetty.client.http.HttpChannelOverHTTP.receive(HttpChannelOverHTTP.java:89)
    at org.eclipse.jetty.client.http.HttpConnectionOverHTTP.onFillable(HttpConnectionOverHTTP.java:123)
    at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
    at java.lang.Thread.run(Thread.java:745)

The event on Salesforce is:

Salesforce platform event

What's the cause of the error?

I found a few possible reasons:

https://developer.salesforce.com/forums/?id=9060G0000005myAQAQ

https://developer.salesforce.com/forums/?id=9060G000000MPEbQAO

but there doesn't seem to be a typo in the event's name or the account's privilege level.

Best Answer

I know it has been a while since this question has been posted, but I've faced the same error message while trying to handle a PushTopic, which is also part of the Salesforce Streaming API.

This problem is caused by attempting to subscribe to a non-existing event. In this case, I'm sure that if the platform event does not exist, it won't work. I'm not sure if the platform event needs to be active (deployed) though. Might be worth checking that out.

Another important thing is that the URL for PushTopics and Platform Events are different. The subscription path for PushTopics is /topic/[topic name] while for the Platform Events the subscription path is /event/[platform event API name].

This similar error was reported by users on the official forums and also on Stack Exchange.

Related Topic