Why does publishing a package from UiPath Studio to UiPath Automation Cloud Orchestrator fail with a "Forbidden" or OrchestratorHttpException: Forbidden error even when the user account has Admin role and all required permissions (Package.Create, Package.Edit, Allow to be Automation Publisher)?
Resolution Steps:
Step 1 — Rule Out Orchestrator Permission Issues
Before investigating network-level causes, confirm the following permissions are assigned to the user account in Orchestrator:
- Allow to be Automation Publisher at target Tenant Level and Automation Publisher at target Folder Level
- If using a custom role, following permissions need to be enabled:
- Packages - View
- Packages - Create
- Packages - Edit
- Confirm the user is connected to the correct Orchestrator tenant and folder in UiPath Studio via Home → Settings → Orchestrator Settings
- Try disconnecting and reconnecting to Orchestrator in Studio to refresh the authentication token
If permissions are correctly configured and the error persists, proceed to Step 2.
Step 2 — Collect UiPath Diagnostic Logs
Collect diagnostic logs using the UiPath Diagnostic Tool to determine whether the 403 response is originating from Automation Cloud Orchestrator or from an intermediate network security component.
Diagnostic Tool log collection guide: https://uipath.my.salesforce-sites.com/CaseView/articles/Knowledge/How-to-collect-the-UiPath-Diagnostic-Tool-logs
Within the logs, look for an HTML response block returned in place of the expected Orchestrator API response. Indicators that confirm a network security gateway is the source of the block include:
- Vendor-specific branding (e.g., Zscaler, Prisma, Forcepoint) present in the response body
- Message:
"Not allowed to access this file type" - Message:
"Website blocked"or"Sorry, you don't have permission to visit this site" - A response originating from a domain other than
cloud.uipath.com
A confirmed network security gateway block will typically surface an HTML page similar to the following within the diagnostic logs:
Sorry, you don't have permission to visit this site.
Website blocked
Not allowed to access this file type
You tried to visit: https://cloud.uipath.com/{organization}/{tenant}/orchestrator_/odata/Processes/...If the above indicators are present in the logs, proceed to Step 3.
Step 3 — Whitelist UiPath Services in the Network Security Gateway
Engage the internal IT or Network Security team to whitelist the required UiPath Automation Cloud endpoints in the network security gateway policy.
The complete and up-to-date list of services and endpoints that UiPath Robot and Studio connect to is available in the official UiPath documentation:
https://docs.uipath.com/robot/standalone/latest/admin-guide/services-the-robot-connects-to
At a minimum, ensure the following domain is permitted in the gateway policy for both standard HTTPS traffic and .nupkg file type uploads:
https://cloud.uipath.comOnce the whitelisting is applied by the network security team, retry publishing the package from UiPath Studio.
Root Cause
A "Forbidden" error during package publishing does not always indicate a permissions issue within UiPath Automation Cloud Orchestrator. While insufficient role assignments are a common cause and should be ruled out first, this error can also be triggered by a network security gateway or web proxy such as Zscaler, Palo Alto Prisma, or similar tools intercepting and blocking the outbound HTTPS upload request to the Automation Cloud Orchestrator endpoint.
In such cases, the HTTP 403 Forbidden response is returned by the network security gateway rather than Orchestrator itself, making the error appear as a UiPath permissions issue when the restriction is actually being enforced at the network layer.
The specific Orchestrator upload endpoint that is typically blocked in such scenarios follows this pattern:
https://cloud.uipath.com/{organization}/{tenant}/orchestrator_/odata/Processes/UiPath.Server.Configuration.O