Check what a NEAR application key can actually sign

A key can still exist after an application loses permission to call a method. Inspect the on-chain permission before replacing the key or changing the contract.

Read the signer’s key

Replace both placeholders with the signer account and public key from the rejected transaction. Query the same network as the signer. The application’s contract address may differ from the account that holds the key.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "query",
  "params": {
    "request_type": "view_access_key",
    "finality": "final",
    "account_id": "alice.testnet",
    "public_key": "ed25519:PUBLIC_KEY"
  }
}

Match the action against the permission

Suppose FunctionCall.receiver_id is shop.testnet and method_names contains only reserve. A call to buy on shop.testnet falls outside that list. Calling reserve on another contract also exceeds the permission. An empty method list allows method names on the specified receiver without that list restriction.

Check the attached deposit and remaining allowance as separate constraints. A restricted function-call key cannot authorize a transfer or a call with a positive attached deposit. Keep the returned block hash with the incident record because permissions can change.

Sources