{"record":{"id":"56f9ee7f12475a34","repo":"tailscale/tailscale","slug":"lock-init-access-denied","errorCode":null,"errorMessage":"lock init access denied","messagePattern":"lock init access denied","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"ipn/localapi/tailnetlock.go","lineNumber":85,"sourceCode":"\t\tRotationPublic []byte\n\t}\n\tvar req signRequest\n\tif err := json.NewDecoder(r.Body).Decode(&req); err != nil {\n\t\thttp.Error(w, \"invalid JSON body\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tif err := h.b.TailnetLockSign(req.NodeKey, req.RotationPublic); err != nil {\n\t\thttp.Error(w, \"signing failed: \"+err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tw.WriteHeader(http.StatusOK)\n}\n\nfunc (h *Handler) serveTKAInit(w http.ResponseWriter, r *http.Request) {\n\tif !h.PermitWrite {\n\t\thttp.Error(w, \"lock init access denied\", http.StatusForbidden)\n\t\treturn\n\t}\n\tif r.Method != httpm.POST {\n\t\thttp.Error(w, \"use POST\", http.StatusMethodNotAllowed)\n\t\treturn\n\t}\n\n\ttype initRequest struct {\n\t\tKeys               []tka.Key\n\t\tDisablementValues  [][]byte\n\t\tSupportDisablement []byte\n\t}\n\tvar req initRequest\n\tif err := json.NewDecoder(r.Body).Decode(&req); err != nil {\n\t\thttp.Error(w, \"invalid JSON body\", http.StatusBadRequest)\n\t\treturn\n\t}\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/ipn/localapi/tailnetlock.go#L67-L103","documentation":"serveTKAInit begins enabling tailnet lock for the tailnet, a privileged write operation. The handler requires PermitWrite; a read-only LocalAPI caller is refused with 403 before any request parsing.","triggerScenarios":"Thrown at ipn/localapi/tailnetlock.go:85 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Initialize tailnet lock as an authorized tailnet admin."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}