# 🔍 Description
## Issue References 🔗
Seems NotAllowedException is used for method not allowed, and currently, we use false constructor, the error message we expected would not be return to client end.
It only told:
```
{"message":"HTTP 405 Method Not Allowed"}
```
Because the message we used to build the NotAllowedException was treated as `allowed` method, not as `message`.

## Describe Your Solution 🔧
We should use the ForbidenException instead, and then the error message we excepted can be visible in client end.
|
||
|---|---|---|
| .. | ||
| src | ||
| web-ui | ||
| pom.xml | ||