{"record":{"id":"5d8a6ce72d57b049","repo":"instructure/canvas-lms","slug":"missing-required-capability","errorCode":null,"errorMessage":"Missing required capability","messagePattern":"Missing required capability","errorType":"exception","errorClass":"Lti::SubscriptionsValidator::MissingCapability","httpStatus":400,"severity":"error","filePath":"app/controllers/lti/subscriptions_validator.rb","lineNumber":53,"sourceCode":"      \"root_account\" => Account,\n      \"assignment\" => Assignment\n    }.freeze\n\n    attr_reader :subscription, :tool_proxy\n\n    def initialize(subscription, tool_proxy)\n      @subscription = subscription.with_indifferent_access\n      @tool_proxy = tool_proxy\n    end\n\n    def check_required_capabilities!\n      capabilities_hash = ToolConsumerProfile.webhook_subscription_capabilities\n      return if tool_proxy.enabled_capabilities.include?(ToolConsumerProfile.webhook_grant_all_capability)\n\n      subscription[:EventTypes].each do |event_type|\n        raise MissingCapability, \"EventType #{event_type} is invalid\" unless capabilities_hash.key?(event_type.to_sym)\n        unless tool_proxy.enabled_capabilities.intersect?(capabilities_hash[event_type.to_sym])\n          raise MissingCapability, \"Missing required capability\"\n        end\n      end\n    end\n\n    def check_tool_context!\n      requested_context = subscription_context\n      requested_context = requested_context.course if requested_context.respond_to?(:course)\n      raise ToolNotInContext, \"Tool does not have access to requested context\" unless tool_proxy.active_in_context?(requested_context)\n    end\n\n    def validate_subscription_request!\n      check_required_capabilities!\n      check_tool_context!\n    end\n\n    def self.validate_subscription_context!(subscription)\n      raise ContextNotFound unless retrieve_context(subscription).present?\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/controllers/lti/subscriptions_validator.rb#L35-L71","documentation":"Raised by Lti::SubscriptionsValidator#check_required_capabilities! when the tool proxy has not been granted (enabled_capabilities) any of the capabilities required for a requested subscription event type. Even a valid event type needs a corresponding granted capability (e.g. .* subscription scopes) unless the tool holds the grant-all capability.","triggerScenarios":"Creating a LiveEvents subscription where EventTypes is valid but tool_proxy.enabled_capabilities does not intersect the required capabilities for that event type; tool approved without the needed webhook scopes.","commonSituations":"Developer installs a tool without checking the required capability checkboxes during tool approval; account admin grants the subscription feature flag but not the capability; new event type added to subscription requires capabilities the tool never had.","solutions":["Edit the tool proxy / developer key to enable the required capabilities for the event type","Grant the webhook grant-all capability if appropriate for the trust relationship","Reduce EventTypes to only events whose capabilities the tool already has","Re-approve the tool with the additional requested capabilities"],"exampleFix":"// before\ntool_proxy.enabled_capabilities = [] # cannot subscribe\ntool_proxy.enabled_capabilities = ['url', 'WebhookSubscription.event_type.subscription_created']\n# after\ntool_proxy.enabled_capabilities = ['url', 'WebhookSubscription.event_type.subscription_created']","handlingStrategy":"validation","validationCode":"caps = ToolConsumerProfile.webhook_subscription_capabilities\nmissing = event_types.flat_map { |e| caps[e.to_sym] || [] } - tool_proxy.enabled_capabilities.to_a","typeGuard":null,"tryCatchPattern":"begin\n  validator.validate_subscription_request!\nrescue Lti::SubscriptionsValidator::MissingCapability\n  request_capability_grant(event_types) # re-approve tool with required capabilities\nend","preventionTips":["Request needed capabilities during tool approval","Grant webhook grant-all only for trusted tools","Audit enabled_capabilities when adding event types"],"tags":["lti","live-events","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}