Significant-Gravitas/AutoGPT · error · HTTPException

Application not found or you don't have permission to update

Error message

Application not found or you don't have permission to update it

What it means

Returned (404) when update_oauth_application finds no application row matching both the given app_id and owner_id while enabling/disabling an OAuth app. The lookup is scoped by owner, so both a non-existent app and an app owned by another user produce this response.

Source

Thrown at autogpt_platform/backend/backend/api/features/oauth.py:596

    is_active: bool = Body(description="Whether the app should be active", embed=True),
) -> OAuthApplicationInfo:
    """
    Enable or disable an OAuth application.

    Only the application owner can update the status.
    When disabled, the application cannot be used for new authorizations
    and existing access tokens will fail validation.

    Returns the updated application info.
    """
    updated_app = await update_oauth_application(
        app_id=app_id,
        owner_id=user_id,
        is_active=is_active,
    )

    if not updated_app:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="Application not found or you don't have permission to update it",
        )

    action = "enabled" if is_active else "disabled"
    logger.info(f"OAuth app {updated_app.name} (#{app_id}) {action} by user #{user_id}")

    return updated_app


class UpdateAppLogoRequest(BaseModel):
    logo_url: str = Field(description="URL of the uploaded logo image")


@router.patch("/apps/{app_id}/logo")
async def update_app_logo(
    app_id: str,
    request: UpdateAppLogoRequest = Body(),

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. List your OAuth apps (GET apps endpoint) and use the exact id of an app you own
2. Confirm the authenticated user is the owner of the app_id in the request
3. If the app was deleted, recreate it and update stored references

apps = await list_my_oauth_apps()
owned = {a.id for a in apps if a.owner_id == current_user_id}
assert app_id in owned, f"app {app_id} not owned by current user"

def can_manage_app(app: OAuthAppInfo, user_id: str) -> bool:
    return app.owner_id == user_id and app.is_active is not None

if resp.status_code == 404:
    # app missing OR not owned — refresh app list before retrying
    apps = list_my_apps(); assert app_id in {a.id for a in apps}

When it happens

Trigger: PATCH/POST enable-disable with a wrong app_id, an app deleted by its owner, or a valid app_id owned by a different user (or the calling user's auth token identifies a different user id).

Common situations: Stale app_id stored client-side after the app was deleted; testing with an account that is not the app owner; user id mismatch after re-authentication or token issued to another account.

Related errors

• OAuth App not found
• Graph #{graph_id} not found.
• Graph #{graph_id} not found.
• Session {session_id} not found.
• Webhook not found

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/76adc0ecc736cb51. Report an issue: GitHub.