OrchardCMS/OrchardCore · error · InvalidOperationException

Not authorized to delete this content

Error message

Not authorized to delete this content

What it means

MetaWeblogHandler's delete-post path fetches the latest version of the content item and then requires the user to pass CommonPermissions.DeleteContent authorization for that specific item. If the check fails, an InvalidOperationException with this message is thrown, aborting the delete. It is a deliberate authorization guard, not a bug.

Solutions

1. Grant the user's role the 'Delete Content' permission (or EditContent of own items per site policy) in Admin > Security > Roles.
2. Use an account with sufficient privileges in the remote blogging client.
3. If deletion is not intended for that role, have the client skip delete and use edit instead.
4. Handle the InvalidOperationException in your XML-RPC client and surface a clear permission message.

// Check the user's role grants DeleteContent before calling blogger.deletePost
var hasDelete = await authorizationService.AuthorizeAsync(user, CommonPermissions.DeleteContent, contentItem);
if (!hasDelete) throw new UnauthorizedAccessException("User cannot delete this content item.");

try { await metaWeblog.DeletePostAsync(appKey, postId, userName, password, publish); }
catch (InvalidOperationException ex) when (ex.Message.Contains("Not authorized"))
{ /* surface a permission-denied message or re-authenticate with a privileged account */ }

When it happens

Trigger: Calling the MetaWeblog 'blogger.deletePost' XML-RPC API with credentials of a user who lacks DeleteContent permission on the target content item. Note CheckAccessAsync (error 372) can also surface the same message text for other verbs.

Common situations: Remote blogging clients (e.g. OpenLiveWriter) configured with an account whose role is author/contributor without delete rights; deleted or archived items where the latest version owner differs; misconfigured roles in a multi-tenant site.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• The username or e-mail or password provided is incorrect.
• Could not find content item
• Not authorized to upload media.
• The media path is invalid.

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/13a7ff046b4d7079. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs:451

        }

        return true;
    }

    private async Task<bool> MetaWeblogDeletePostAsync(
        string contentItemId,
        string userName,
        string password,
        IEnumerable<IXmlRpcDriver> drivers)
    {
        var user = await ValidateUserAsync(userName, password);

        var contentItem = (await _contentManager.GetAsync(contentItemId, VersionOptions.Latest))
            ?? throw new InvalidOperationException("Could not find content item " + contentItemId);

        if (!await _authorizationService.AuthorizeAsync(user, CommonPermissions.DeleteContent, contentItem))
        {
            throw new InvalidOperationException(S["Not authorized to delete this content"].Value);
        }

        foreach (var driver in drivers)
        {
            driver.Process(contentItem.ContentItemId);
        }

        await _contentManager.RemoveAsync(contentItem);
        return true;
    }

    private async Task<ClaimsPrincipal> ValidateUserAsync(string userName, string password)
    {
        if (!await _membershipService.CheckPasswordAsync(userName, password))
        {
            throw new InvalidOperationException(S["The username or e-mail or password provided is incorrect."].Value);
        }

View on GitHub (pinned to 4306c0717f)