{"record":{"id":"3f8f922e75234bb6","repo":"goharbor/harbor","slug":"denied-3f8f92","errorCode":"DENIED","errorMessage":"permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s","messagePattern":"permission scope is invalid\\. It must be equal to or more restrictive than the creator robot's permissions: (.+?)","errorType":"http","errorClass":"errors.Error","httpStatus":403,"severity":"error","filePath":"src/server/v2.0/handler/robot.go","lineNumber":92,"sourceCode":"\t\t},\n\t\tLevel:           params.Robot.Level,\n\t\tProjectNameOrID: params.Robot.Permissions[0].Namespace,\n\t}\n\n\tif err := rAPI.requireAccess(ctx, r, rbac.ActionCreate); err != nil {\n\t\treturn rAPI.SendError(ctx, err)\n\t}\n\n\tvar creatorRef int64\n\tswitch s := sc.(type) {\n\tcase *local.SecurityContext:\n\t\tcreatorRef = int64(s.User().UserID)\n\tcase *robotSc.SecurityContext:\n\t\tif s.User() == nil {\n\t\t\treturn rAPI.SendError(ctx, errors.New(nil).WithMessage(\"invalid security context: empty robot account\"))\n\t\t}\n\t\tif !isValidPermissionScope(params.Robot.Permissions, s.User().Permissions) {\n\t\t\treturn rAPI.SendError(ctx, errors.New(nil).WithMessagef(\"permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s\", s.User().Name).WithCode(errors.DENIED))\n\t\t}\n\t\tcreatorRef = s.User().ID\n\tdefault:\n\t\treturn rAPI.SendError(ctx, errors.New(nil).WithMessage(\"invalid security context\"))\n\t}\n\tr.CreatorType = sc.Name()\n\tr.CreatorRef = creatorRef\n\n\tif err := lib.JSONCopy(&r.Permissions, params.Robot.Permissions); err != nil {\n\t\tlog.Warningf(\"failed to call JSONCopy on robot permission when CreateRobot, error: %v\", err)\n\t}\n\n\tif err := robot.SetProject(ctx, r); err != nil {\n\t\treturn rAPI.SendError(ctx, err)\n\t}\n\n\trid, pwd, err := rAPI.robotCtl.Create(ctx, r)\n\tif err != nil {","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/server/v2.0/handler/robot.go#L74-L110","documentation":"Error \"permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s\" thrown in goharbor/harbor.","triggerScenarios":"Thrown at src/server/v2.0/handler/robot.go:92 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}