HumanSignal/label-studio · error · PermissionDenied

You can delete members only for your current active organiza

Error message

You can delete members only for your current active organization

What it means

DRF PermissionDenied raised by OrganizationMemberDeleteView.delete when the target organization (resolved from the URL via parent_object) is not the requesting user's currently active organization. Member deletion is only permitted within the session's active org.

Source

Thrown at label_studio/organizations/api.py:306

    def get_serializer_context(self):
        return {
            **super().get_serializer_context(),
            'organization': self.parent_object,
            'contributed_to_projects': bool_from_request(self.request.GET, 'contributed_to_projects', False),
        }

    def get(self, request, pk, user_pk):
        queryset = self.get_queryset()
        member = get_object_or_404(queryset, user=user_pk)
        self.check_object_permissions(request, member)
        serializer = self.get_serializer(member)
        return Response(serializer.data)

    def delete(self, request, pk=None, user_pk=None):
        org = self.parent_object
        if org != request.user.active_organization:
            raise PermissionDenied('You can delete members only for your current active organization')

        user = get_object_or_404(User, pk=user_pk)
        member = get_object_or_404(OrganizationMember, user=user, organization=org)
        if member.deleted_at is not None:
            raise NotFound('Member not found')

        if member.user_id == request.user.id:
            return Response({'detail': 'User cannot soft delete self'}, status=status.HTTP_405_METHOD_NOT_ALLOWED)

        return self._delete_member(request, user, member)

    def _delete_member(self, request, user, member):
        """Perform the actual member removal. Override in subclasses to add pre-delete hooks."""
        member.soft_delete()
        return Response(status=204)  # 204 No Content is a common HTTP status for successful delete requests


@method_decorator(

View on GitHub (pinned to 0b49e9b539)

Solutions

1. Switch the active organization (PATCH active_organization on the user or re-authenticate scoped to the target org) before deleting
2. Call the delete endpoint with the org id matching your active organization
3. Ensure the authenticated user is a member/admin of the org and that client state sets it active

Example fix

// before
curl -X DELETE /api/organizations/5/members/42  # active org is 3
// after
# switch active org to 5 first, then:
curl -X DELETE /api/organizations/5/members/42

const orgOk = targetOrgId === currentUser.active_organization;
if (!orgOk) await switchActiveOrganization(targetOrgId); // before DELETE

try:
    delete_member(org_id, user_pk)
except PermissionDenied:
    set_active_organization(org_id)
    delete_member(org_id, user_pk)

When it happens

Trigger: DELETE /api/organizations/{pk}/members/{user_pk} (or equivalent) where pk refers to an org other than request.user.active_organization.

Common situations: Admin belongs to multiple organizations and the UI/CLI session's active org differs from the target; scripts hitting the endpoint with an org id without switching active organization first; stale session after org switch.

Related errors

• PermissionDenied
• You do not have permission to create storages for this proje
• Invalid or missing serializer class
• "file_upload_ids" parameter must be a list of integers
• Action is not allowed for the current user: {action_id}

AI-assisted analysis of HumanSignal/label-studio@0b49e9b539 (2026-08-29). Data as JSON: /api/errors/92a1350989462ece. Report an issue: GitHub.