{"record":{"id":"2b04a9d056b93cf2","repo":"payloadcms/payload","slug":"collection-args-collection-config-slug-has-disa-2b04a9","errorCode":null,"errorMessage":"Collection ${args.collection.config.slug} has disabled bulk edit","messagePattern":"Collection (.+?) has disabled bulk edit","errorType":"http","errorClass":"APIError","httpStatus":403,"severity":"error","filePath":"packages/payload/src/collections/operations/update.ts","lineNumber":77,"sourceCode":"   * @example '-createdAt' // Sort DESC by createdAt\n   * @example ['group', '-createdAt'] // sort by 2 fields, ASC group and DESC createdAt\n   */\n  sort?: Sort\n  trash?: boolean\n  unpublishAllLocales?: boolean\n  where: Where\n} & Pick<FindOptions<TSlug, SelectType>, 'select'>\n\nexport const updateOperation = async <\n  TSlug extends CollectionSlug,\n  TSelect extends SelectFromCollectionSlug<TSlug>,\n>(\n  incomingArgs: Arguments<TSlug>,\n): Promise<BulkOperationResult<TSlug, TSelect>> => {\n  let args = incomingArgs\n\n  if (args.collection.config.disableBulkEdit && !args.overrideAccess) {\n    throw new APIError(`Collection ${args.collection.config.slug} has disabled bulk edit`, 403)\n  }\n\n  try {\n    const shouldCommit = !args.disableTransaction && (await initTransaction(args.req))\n\n    // /////////////////////////////////////\n    // beforeOperation - Collection\n    // /////////////////////////////////////\n\n    args = await buildBeforeOperation({\n      args,\n      collection: args.collection.config,\n      operation: 'update',\n      overrideAccess: args.overrideAccess!,\n    })\n\n    const {\n      autosave = false,","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/collections/operations/update.ts#L59-L95","documentation":"Thrown at packages/payload/src/collections/operations/update.ts:77 with HTTP 403 at the top of `updateOperation` (the bulk/many-documents update path) when the collection config has `disableBulkEdit: true` AND `overrideAccess` is falsy. It prevents non-privileged callers from performing bulk edits on collections where the operator has explicitly disabled them. Note: `overrideAccess: true` bypasses this guard entirely.","triggerScenarios":"Calling `payload.update({ collection: 'orders', where: {...}, data })` (many-doc form) while the user is authenticated (`overrideAccess` false/default in REST) and the collection sets `disableBulkEdit: true`; an admin UI bulk-edit attempt on such a collection.","commonSituations":"Setting `disableBulkEdit: true` on transactional collections (orders, invoices) but leaving bulk-edit UI/actions enabled; a refactor that switched a call from single-doc update to the many-doc form.","solutions":["If bulk edit must stay disabled, update documents one at a time via the single-id form (`payload.update({ collection, id, data })`).","If bulk edit should be allowed, remove `disableBulkEdit` (or set `false`) on the collection config.","Only pass `overrideAccess: true` from trusted server-side code; never expose it to client input."],"exampleFix":"// before — collection has disableBulkEdit: true, caller uses overrideAccess: false\nawait payload.update({ collection: 'orders', where: { status: { equals: 'pending' } }, data })\n\n// after — update one document at a time\nfor (const id of ids) {\n  await payload.update({ collection: 'orders', id, data })\n}\n// or, in trusted server code, override access:\nawait payload.update({ collection: 'orders', where: { status: { equals: 'pending' } }, data, overrideAccess: true })","handlingStrategy":"validation","validationCode":"function assertBulkEditAllowed(payload: Payload, slug: CollectionSlug, overrideAccess: boolean): void {\n  const collection = payload.collections[slug]\n  if (collection?.config.disableBulkEdit && !overrideAccess) {\n    throw new Error(`Collection '${slug}' has disabled bulk edit.`)\n  }\n}\n\nassertBulkEditAllowed(payload, 'orders', false)\n// if it throws, switch to single-doc updates or pass overrideAccess: true in trusted code","typeGuard":"const bulkEditAllowed = (\n  payload: Payload,\n  slug: CollectionSlug,\n  overrideAccess: boolean,\n): boolean => {\n  const c = payload.collections[slug]\n  return Boolean(c) && (c.config.disableBulkEdit !== true || overrideAccess === true)\n}","tryCatchPattern":"try {\n  await payload.update({ collection: slug, where, data })\n} catch (err) {\n  if (err instanceof APIError && err.status === 403 && /disabled bulk edit/.test(err.message)) {\n    // fall back to per-document updates, or escalate overrideAccess in trusted server code\n  } else throw err\n}","preventionTips":["When you set disableBulkEdit: true, also disable bulk-edit UI/actions for that collection.","Prefer the single-doc update form ({ collection, id, data }) for transactional collections.","Never let client input control overrideAccess."],"tags":["local-api","update","bulk-edit","configuration","forbidden"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}