---
title: Error Handling & Best Practices
url: https://docs.kaltura.com/docs/rich-media-cms-apis/content-management/access-control-reference
---

## Error Handling & Best Practices

### Error Handling


| Error Code | Meaning |
|------------|---------|
| `ACCESS_CONTROL_NOT_FOUND` | Profile ID does not exist |
| HTTP 403 on delivery | Access denied by access control rules -- check KS, referrer, IP, geo restrictions |
| `INVALID_OBJECT_TYPE` | Wrong objectType in rule, condition, or action definition |
| Empty `actions` on getContextData | No rules matched -- content is allowed |
| `isScheduledNow=false` on getContextData | Entry is outside its scheduling window |




### Best Practices


- **Start simple, add complexity as needed.** Begin with basic rules (IP, country) and expand. Complex rule chains are harder to debug when access is unexpectedly blocked.  
- **Use `stopProcessing` for allow-then-block patterns.** To allow specific conditions and block everything else, create a whitelist rule with `stopProcessing=true`, followed by a catch-all block rule with no conditions.  
- **Set explicit contexts on rules.** Rules without contexts evaluate in all contexts. Set PLAY, DOWNLOAD, or THUMBNAIL explicitly to enable split access (e.g., allow thumbnails but block playback).  
- **Use `baseEntry.getContextData` for UX.** Check scheduling and access control before attempting playback to show user-friendly messages instead of blank screens.  
- **Test access control profiles.** Use `baseEntry.getContextData` with different `ip`, `referrer`, and `userAgent` scope values to simulate different access scenarios without needing actual devices.  
- **Assign profiles via `accessControlId`.** Set on entry creation or update. To revert to the partner default, set `accessControlId` to the default profile ID (found via `accessControlProfile.list` with `isDefault=1`).  
- **Server-side enforcement.** Access control is enforced on the Kaltura servers, not client-side. Rules apply regardless of which player or device is used.