SigNoz/signoz · error · errors.Error

CodeInvalidInput

CodeInvalidInput

Error message

users cannot call this api on self

What it means

UpdateUser rejects requests where the target userID equals the authenticated caller's userID — self-updates must go through the 'update my user' endpoint instead (different validation/fields apply).

Source

Thrown at pkg/modules/user/impluser/handler.go:188

	}

	render.Success(w, http.StatusOK, users)
}

func (handler *handler) UpdateUser(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
	defer cancel()

	userID := mux.Vars(r)["id"]

	claims, err := authtypes.ClaimsFromContext(ctx)
	if err != nil {
		render.Error(w, err)
		return
	}

	if userID == claims.UserID {
		render.Error(w, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "users cannot call this api on self"))
		return
	}

	updatableUser := new(types.UpdatableUser)
	if err := json.NewDecoder(r.Body).Decode(&updatableUser); err != nil {
		render.Error(w, err)
		return
	}

	_, err = handler.setter.UpdateUser(ctx, valuer.MustNewUUID(claims.OrgID), valuer.MustNewUUID(userID), updatableUser)
	if err != nil {
		render.Error(w, err)
		return
	}

	render.Success(w, http.StatusNoContent, nil)
}

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Use the dedicated 'update my user' endpoint for self-updates (UpdateMyUser route)
2. Pass the target user's actual ID (not the caller's) when admins edit other users
3. Check claims.UserID vs path param before sending the request

Example fix

// before
if claims.UserID == userID { updateUser(userID, patch) } // 400
// after
if claims.UserID == userID { updateMyUser(patch) } else { updateUser(userID, patch) }

if targetUserID == claims.UserID {
    err := updateMyUser(patch) // self endpoint
} else {
    err := updateUser(targetUserID, patch)
}

When it happens

Trigger: PUT/PATCH /api/v1/users/{userID} where {userID} == claims.UserID of the JWT used; also triggered when UpdateMyUser forwards to UpdateUser with the same ID.

Common situations: Frontend reusing the admin user-edit form for the logged-in profile page; passing the wrong ID (defaulting to current user) in automation scripts.

Related errors

• CodeForbidden
• ErrCodeIncorrectPassword
• CodeLicenseUnavailable
• CodeLicenseUnavailable
• CodeInvalidInput

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/beeb8f068fb4fa4a. Report an issue: GitHub.