{"record":{"id":"1584fbe27bd2fbcb","repo":"hcengineering/platform","slug":"you-do-not-have-write-access-to-the-target-workspa","errorCode":null,"errorMessage":"You do not have write access to the target workspace. Owner role required.","messagePattern":"You do not have write access to the target workspace\\. Owner role required\\.","errorType":"http","errorClass":"ApiError","httpStatus":403,"severity":"error","filePath":"services/export/pod-export/src/server.ts","lineNumber":528,"sourceCode":"        }\n\n        // Get target workspace info\n        const accountClient = getClient(envConfig.AccountsUrl, token)\n        const targetWsLoginInfo = await accountClient.getLoginWithWorkspaceInfo()\n\n        const targetWsInfo = targetWsLoginInfo.workspaces[targetWorkspace]\n        if (targetWsInfo === undefined) {\n          measureCtx.warn(`Target workspace not found or not accessible: ${targetWorkspace}`)\n          throw new ApiError(404, 'Target workspace not found or not accessible')\n        }\n\n        // Verify user has write access to target workspace\n        const isAdmin: boolean = decodedToken.extra?.admin === 'true'\n        if (!isAdmin && targetWsInfo.role !== AccountRole.Owner) {\n          measureCtx.warn(\n            `User does not have write access to target workspace: ${targetWorkspace}, role: ${targetWsInfo.role}`\n          )\n          throw new ApiError(403, 'You do not have write access to the target workspace. Owner role required.')\n        }\n\n        const targetWsIds: WorkspaceIds = {\n          uuid: targetWorkspace,\n          dataId: targetWsInfo.dataId,\n          url: targetWsInfo.url\n        }\n\n        const targetToken = generateToken(decodedToken.account, targetWorkspace, {\n          service: 'export'\n        })\n\n        // Create clients for both workspaces\n        const sourceClient = await createPlatformClient(token)\n        const targetClient = await createPlatformClient(targetToken)\n        const targetTxOps = new TxOperations(targetClient, socialId)\n\n        try {","sourceCodeStart":510,"sourceCodeEnd":546,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/services/export/pod-export/src/server.ts#L510-L546","documentation":"Export writes data into the target workspace, so the server requires write privileges. This HTTP 403 is thrown when the token is not an admin (decodedToken.extra.admin !== 'true') AND the user's role in the target workspace is not AccountRole.Owner.","triggerScenarios":"Running an export with a token belonging to a user whose role in the target workspace is Member/Guest/Read only, or an unprivileged account without the admin extra flag set to 'true'.","commonSituations":"Migrations performed by regular users into workspaces owned by someone else; CI/service accounts with only member role; assuming admin of the source workspace grants rights in the target workspace.","solutions":["Ask the target workspace owner to grant your account the Owner role in that workspace.","Use a token belonging to the target workspace's owner or an admin account (extra.admin='true').","Export into a workspace you own instead."],"exampleFix":"// before\nconst token = memberAccountToken\n// after\nconst token = workspaceOwnerAccountToken // role: Owner in target workspace","handlingStrategy":"validation","validationCode":"const info = await accountClient.getLoginWithWorkspaceInfo()\nconst ws = info.workspaces[targetWorkspace]\nconst isAdmin = decodedToken.extra?.admin === 'true'\nif (!ws || (!isAdmin && ws.role !== AccountRole.Owner)) {\n  throw new Error(`Account needs Owner role (or admin) in ${targetWorkspace}; has: ${ws?.role}`)\n}","typeGuard":"function hasWriteAccess(decoded: DecodedToken, ws: WorkspaceInfo): boolean {\n  return decoded.extra?.admin === 'true' || ws.role === AccountRole.Owner\n}","tryCatchPattern":"try {\n  await exportPod({ targetWorkspace })\n} catch (err) {\n  if (err instanceof ApiError && err.status === 403 && /write access/.test(err.message)) {\n    console.error('Re-run with a token whose account owns the target workspace')\n  } else throw err\n}","preventionTips":["Check the account's role in the target workspace before starting long migrations.","Run migrations with the workspace owner's credentials.","Don't assume rights in the target workspace from admin status in the source workspace."],"tags":["auth","permissions","forbidden","workspace"],"backgroundTag":"insufficient-workspace-permissions","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}