{"record":{"id":"32c117a16403438f","repo":"Significant-Gravitas/AutoGPT","slug":"system-managed-credentials-cannot-be-deleted","errorCode":null,"errorMessage":"System-managed credentials cannot be deleted","messagePattern":"System-managed credentials cannot be deleted","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"autogpt_platform/backend/backend/api/external/v1/integrations.py","lineNumber":634,"sourceCode":"    provider: Annotated[str, Path(title=\"The provider\")],\n    cred_id: Annotated[str, Path(title=\"The credential ID to delete\")],\n    auth: APIAuthorizationInfo = Security(\n        require_permission(APIKeyPermission.DELETE_INTEGRATIONS)\n    ),\n) -> DeleteCredentialResponse:\n    \"\"\"\n    Delete a credential.\n\n    Note: This does not revoke the tokens with the provider. For full cleanup,\n    use the main API's delete endpoint which handles webhook cleanup and\n    token revocation.\n    \"\"\"\n    if is_sdk_default(cred_id):\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND, detail=\"Credentials not found\"\n        )\n    if is_system_credential(cred_id):\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"System-managed credentials cannot be deleted\",\n        )\n    creds = await creds_manager.store.get_creds_by_id(auth.user_id, cred_id)\n    if not creds:\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND, detail=\"Credentials not found\"\n        )\n    if not provider_matches(creds.provider, provider):\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND, detail=\"Credentials not found\"\n        )\n\n    await creds_manager.delete(auth.user_id, cred_id)\n\n    return DeleteCredentialResponse(deleted=True, credentials_id=cred_id)\n","sourceCodeStart":616,"sourceCodeEnd":651,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/external/v1/integrations.py#L616-L651","documentation":"Raised (HTTP 403) by the external delete-credential endpoint when `is_system_credential(cred_id)` is true — the credential is system-managed (e.g. provisioned by operators for all users). Unlike unknown ids (404), this is an explicit authorization refusal: the credential exists but the external API is not allowed to remove it.","triggerScenarios":"DELETE `/integrations/{provider}/credentials/{cred_id}` targeting a system-managed credential id.","commonSituations":"Shared operator-provisioned credentials appearing in a user's integration list; automated cleanup sweeps that iterate all visible credentials.","solutions":["Do not delete system-managed credentials; exclude them from automated cleanup.","If removal is genuinely required, ask the platform operator to unprovision it server-side.","Distinguish 403 (exists, forbidden) from 404 (doesn't exist / not yours) in client error handling."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"SYSTEM_CRED_IDS = load_system_credential_ids()  # operator-provisioned set\nif cred_id in SYSTEM_CRED_IDS:\n    skip(\"system-managed credential; not deletable via API\")","typeGuard":null,"tryCatchPattern":"try:\n    client.delete(f\"/integrations/{provider}/credentials/{cred_id}\")\nexcept HTTPError as e:\n    if e.response.status_code == 403 and \"System-managed\" in e.response.text:\n        log(\"skip system credential\", cred_id)  # expected; requires operator action\n    else:\n        raise","preventionTips":["Filter system-managed credentials out of automated deletion sweeps.","Distinguish 403 (system-owned) from 404 (missing) in client error maps."],"tags":["credentials","delete","forbidden","system-managed"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}