{"record":{"id":"628bfe5f7c796233","repo":"dgraph-io/dgraph","slug":"enable-acl-to-use-this-mutation","errorCode":null,"errorMessage":"Enable ACL to use this mutation","messagePattern":"Enable ACL to use this mutation","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/resolve/middlewares.go","lineNumber":221,"sourceCode":"\t\t\treturn resolved, false\n\t\t}\n\t\treturn resolver.Resolve(ctx, mutation)\n\t})\n}\n\nfunc LoggingMWMutation(resolver MutationResolver) MutationResolver {\n\treturn MutationResolverFunc(func(ctx context.Context, mutation schema.Mutation) (*Resolved,\n\t\tbool) {\n\t\tglog.Infof(\"GraphQL admin mutation. Name =  %v\", mutation.Name())\n\t\treturn resolver.Resolve(ctx, mutation)\n\t})\n}\n\nfunc AclOnlyMW4Mutation(resolver MutationResolver) MutationResolver {\n\treturn MutationResolverFunc(func(ctx context.Context, mutation schema.Mutation) (*Resolved,\n\t\tbool) {\n\t\tif !x.WorkerConfig.AclEnabled {\n\t\t\treturn EmptyResult(mutation, errors.New(\"Enable ACL to use this mutation\")), false\n\t\t}\n\t\treturn resolver.Resolve(ctx, mutation)\n\t})\n}\n","sourceCodeStart":203,"sourceCodeEnd":226,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/resolve/middlewares.go#L203-L226","documentation":"This guard middleware wraps GraphQL mutations and rejects them when ACL (Access Control Lists) is not enabled on the cluster (x.WorkerConfig.AclEnabled is false). Mutations guarded by AclOnlyMW4Mutation require ACL so that permission records exist; without ACL the operation is refused. The resolver returns an empty result with the error and a false 'ok', short-circuiting execution.","triggerScenarios":"Sending any guarded mutation (e.g. adding/dropping data or permission-related admin mutations) while the Dgraph cluster runs without ACL enabled in its configuration.","commonSituations":"Running a local/dev cluster without --acl options (or without the enterprise license) then attempting enterprise-only mutations; forgetting to enable ACL after upgrading; misconfigured Zero/Alpha flags so AclEnabled is false on some nodes.","solutions":["Enable ACL on the cluster (restart Zero/Alpha with ACL flags and a valid enterprise license if needed)","Use a mutation not guarded by AclOnlyMW4Mutation for non-ACL setups","Verify x.WorkerConfig.AclEnabled is true on the node serving the request","If ACL was just enabled, confirm config was reloaded/restarted across all nodes"],"exampleFix":"// before\ndgraph zero --my=... # no ACL flags\n// after\ndgraph zero --my=... --acl-access-ttl=24h --acl-secret-file=hub_enc","handlingStrategy":"try-catch","validationCode":"// client: check cluster config / docs before sending ACL-guarded mutations\nif (!clusterConfig.aclEnabled) {\n  return Promise.reject(new Error('Enable ACL to use this mutation'));\n}","typeGuard":null,"tryCatchPattern":"try {\n  await graphqlMutation(mutation);\n} catch (err) {\n  if (err.message.includes('Enable ACL to use this mutation')) {\n    // surface a clear ops message: enable ACL or use an unguarded mutation\n  }\n}","preventionTips":["Enable ACL in dev environments matching production","Document which mutations require ACL","Verify AclEnabled on all nodes after config changes","Feature-flag enterprise mutations behind an ACL-enabled check"],"tags":["acl","authorization","configuration"],"backgroundTag":"acl-disabled","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}