{"record":{"id":"3092fd96492108be","repo":"gotify/server","slug":"you-are-not-allowed-to-access-this-api","errorCode":null,"errorMessage":"you are not allowed to access this api","messagePattern":"you are not allowed to access this api","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"api/user.go","lineNumber":226,"sourceCode":"\t\t}\n\n\t\tvar requestedBy *model.User\n\t\tuid := auth.TryGetUserID(ctx)\n\t\tif uid != nil {\n\t\t\trequestedBy, err = a.DB.GetUserByID(*uid)\n\t\t\tif err != nil {\n\t\t\t\tctx.AbortWithError(http.StatusInternalServerError, fmt.Errorf(\"could not get user: %s\", err))\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tif requestedBy == nil || !requestedBy.Admin {\n\t\t\tstatus := http.StatusUnauthorized\n\t\t\tif requestedBy != nil {\n\t\t\t\tstatus = http.StatusForbidden\n\t\t\t}\n\t\t\tif !a.Registration {\n\t\t\t\tctx.AbortWithError(status, errors.New(\"you are not allowed to access this api\"))\n\t\t\t\treturn\n\t\t\t}\n\t\t\tif internal.Admin {\n\t\t\t\tctx.AbortWithError(status, errors.New(\"you are not allowed to create an admin user\"))\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tif existingUser == nil {\n\t\t\tif success := successOrAbort(ctx, 500, a.DB.CreateUser(internal)); !success {\n\t\t\t\treturn\n\t\t\t}\n\t\t\tif err := a.UserChangeNotifier.fireUserAdded(internal.ID); err != nil {\n\t\t\t\tctx.AbortWithError(500, err)\n\t\t\t\treturn\n\t\t\t}\n\t\t\tctx.JSON(200, toExternalUser(internal))\n\t\t} else {","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/gotify/server/blob/14bfc256276775c425f988d621dccfe705de18ac/api/user.go#L208-L244","documentation":"Returned by CreateUser when the caller lacks permission to create users. A non-admin (or anonymous) requester is only tolerated when self-registration is enabled (a.Registration); otherwise the API aborts with 401 (anonymous) or 403 (authenticated non-admin). It is an authorization gate, evaluated before any user record is written.","triggerScenarios":"POST /api/users without admin credentials while registration is disabled; a logged-in non-admin attempting to create an arbitrary user; unauthenticated request when a.Registration is false; admin flag sent in the payload by a non-admin caller with registration disabled.","commonSituations":"CI scripts calling the user-creation API with a service token that is not an admin; disabling open registration after previously allowing it, breaking old signup calls; forgetting to pass the admin session when automating user provisioning; reverse proxy dropping the Authorization header so the request is seen as anonymous.","solutions":["Authenticate the request as an admin user (Basic auth with an account whose Admin=true)","Enable registration (config flag mapped to a.Registration) if self-service signup is intended","Ensure the admin Authorization header is not stripped by proxies/client code","For self-registration, do not attempt to set the admin flag and call the register route with registration enabled"],"exampleFix":"// before\ncurl -X POST https://host/api/users -d '{\"username\":\"bob\"}'  // 403, non-admin\n// after\ncurl -X POST https://host/api/users -u 'admin:s3cret' -d '{\"username\":\"bob\"}'","handlingStrategy":"validation","validationCode":"// client-side pre-check before calling createUser\nif (!isAdminAccount(currentUser) && !registrationEnabled) {\n  throw new Error('user creation requires an admin account (registration is disabled)');\n}","typeGuard":"function canCreateUsers(requester) {\n  return requester != null && requester.admin === true;\n}","tryCatchPattern":"try {\n  await api.createUser(payload, { auth: adminCredentials });\n} catch (e) {\n  if (e.status === 401 || e.status === 403) { log('not permitted: use admin credentials or enable registration'); }\n  else { throw e; }\n}","preventionTips":["Provision automation with a dedicated admin service account","Mirror the server's registration flag in client config and check it first","After toggling registration off, audit and update any scripts that relied on it","Confirm Authorization headers survive proxies for machine clients"],"tags":["http","authorization","permissions","admin"],"backgroundTag":"insufficient-permissions","analyzedSha":"14bfc256276775c425f988d621dccfe705de18ac","analyzedAt":"2026-09-05T12:52:36.781Z","contentChangedAt":"2026-09-05T12:52:36.781Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}