{"record":{"id":"45437a01329d7a32","repo":"mem0ai/mem0","slug":"http-resp-status-detail","errorCode":null,"errorMessage":"HTTP ${resp.status}: ${detail}","messagePattern":"HTTP (.+?): (.+?)","errorType":"http","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/node/src/backend/platform.ts","lineNumber":93,"sourceCode":"\t\t\ttry {\n\t\t\t\tconst body = (await resp.json()) as Record<string, unknown>;\n\t\t\t\tdetail =\n\t\t\t\t\t((body.detail ?? body.message ?? JSON.stringify(body)) as string) ??\n\t\t\t\t\tresp.statusText;\n\t\t\t} catch {\n\t\t\t\tdetail = resp.statusText;\n\t\t\t}\n\t\t\tthrow new APIError(path, detail);\n\t\t}\n\t\tif (!resp.ok) {\n\t\t\tlet detail: string = resp.statusText;\n\t\t\ttry {\n\t\t\t\tconst body = (await resp.json()) as Record<string, unknown>;\n\t\t\t\tdetail = (body.detail ?? body.message ?? resp.statusText) as string;\n\t\t\t} catch {\n\t\t\t\t/* ignore */\n\t\t\t}\n\t\t\tthrow new Error(`HTTP ${resp.status}: ${detail}`);\n\t\t}\n\t\tif (resp.status === 204) {\n\t\t\treturn {};\n\t\t}\n\n\t\tconst data = await resp.json();\n\n\t\t// Pull the unclaimed-Agent-Mode notice out of the body (or the header\n\t\t// fallback for endpoints returning non-dict / non-dict-leading payloads)\n\t\t// and stash for end-of-command surfacing.\n\t\tlet notice: string | null = null;\n\t\tif (\n\t\t\tdata &&\n\t\t\ttypeof data === \"object\" &&\n\t\t\t!Array.isArray(data) &&\n\t\t\t\"mem0_notice\" in data\n\t\t) {\n\t\t\tnotice = (data as Record<string, unknown>).mem0_notice as string;","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/cli/node/src/backend/platform.ts#L75-L111","documentation":"Raised inside require_admin when authentication came via ADMIN_API_KEY or AUTH_DISABLED, a default user was found in the users table, but that default user's role is not 'admin' (e.g. 'member'). The bootstrap path assumes the first user is an admin; a non-admin first user blocks admin access for the admin-key/disabled paths. This is a 403.","triggerScenarios":"AUTH_DISABLED=true or ADMIN_API_KEY set, the first user in the users table was created with a non-admin role (custom DB seed, manual insert, or a role change), then calling an admin endpoint such as DELETE /memories or POST /reset.","commonSituations":"Someone seeded the database with a regular member user before any admin existed; an operator downgraded the first user's role in the DB; a deployment script creates a default non-admin user for testing.","solutions":["Promote the first user to admin: UPDATE users SET role='admin' WHERE id=<first_user_id>, or re-create the DB so /setup can register the first user as admin.","Authenticate as an existing user whose role is 'admin' with a Bearer token instead of ADMIN_API_KEY/AUTH_DISABLED.","If the users table has no admin at all, wipe users and re-run /setup so the first registered account becomes admin."],"exampleFix":"-- before\nSELECT role FROM users LIMIT 1;  -- 'member'\n\n-- after\nUPDATE users SET role='admin' WHERE id = (SELECT id FROM users ORDER BY created_at LIMIT 1);","handlingStrategy":"validation","validationCode":"users = admin_client.get(f\"{BASE}/users\").json()\nif users and getattr(users[0], \"role\", \"member\") != \"admin\":\n    raise RuntimeError(\"First user must have role='admin' for ADMIN_API_KEY/AUTH_DISABLED paths\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only seed the DB with an admin as the first user.","Never downgrade the first-created user without promoting another admin.","Audit roles after any manual DB seeding."],"tags":["auth","http-403","authorization","rest-server"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}