{"record":{"id":"635cc07f3a6af0d8","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-635cc0","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/queues/localAPI.ts","lineNumber":122,"sourceCode":"            ? TTaskOrWorkflowSlug\n            : never\n        },\n  ): Promise<\n    TTaskOrWorkflowSlug extends keyof TypedJobs['workflows']\n      ? Job<TTaskOrWorkflowSlug>\n      : JobFromTask<TTaskOrWorkflowSlug>\n  > => {\n    const overrideAccess = args?.overrideAccess !== false\n    const req: PayloadRequest = args.req ?? (await createLocalReq({}, payload))\n\n    if (!overrideAccess) {\n      /**\n       * By default, jobsConfig.access.queue will be `defaultAccess` which is a function that returns `true` if the user is logged in.\n       */\n      const accessFn = payload.config.jobs?.access?.queue ?? (() => true)\n      const hasAccess = await accessFn({ req })\n      if (!hasAccess) {\n        throw new Forbidden(req.t)\n      }\n    }\n\n    let queue: string | undefined = undefined\n\n    // If user specifies queue, use that\n    if (args.queue) {\n      queue = args.queue\n    } else if (args.workflow) {\n      // Otherwise, if there is a workflow specified, and it has a default queue to use,\n      // use that\n      const workflow = payload.config.jobs?.workflows?.find(({ slug }) => slug === args.workflow)\n      if (workflow?.queue) {\n        queue = workflow.queue\n      }\n    }\n\n    const data: Partial<Job> = {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/queues/localAPI.ts#L104-L140","documentation":"Thrown by the jobs Local API `queue` function (Forbidden, from `req.t`) when `overrideAccess` is not explicitly false AND the configured `jobsConfig.access.queue` returns false. By default that access function returns true only for logged-in users, so anonymous queueing is denied.","triggerScenarios":"Calling `payload.jobs.queue({ workflow, data, req })` with a request whose `access.queue` returns false — typically because `req.user` is absent (default access = `Boolean(user)`), or a custom access function denies the user.","commonSituations":"Queueing a job from a public/anonymous endpoint without auth; a custom `jobs.access.queue` that is too restrictive; using a server `req` that was never authenticated.","solutions":["Authenticate the request before queueing so the default access passes.","Broaden `jobsConfig.access.queue` to allow the intended caller (e.g. service accounts).","For trusted internal calls, pass `overrideAccess: true` explicitly."],"exampleFix":"// before\nawait payload.jobs.queue({ workflow: 'email', data, req })\n\n// after\n// trusted internal path\nawait payload.jobs.queue({ workflow: 'email', data, req, overrideAccess: true })","handlingStrategy":"validation","validationCode":"if (!req.user && args?.overrideAccess !== true) {\n  // default access.queue returns Boolean(user); queue will be Forbidden\n  throw new Error('queue requires an authenticated user or overrideAccess: true')\n}\n\nawait payload.jobs.queue({ workflow, data, req, overrideAccess: trusted })","typeGuard":"import type { PayloadRequest, User } from 'payload'\n\nfunction isAuthenticated(req: PayloadRequest): req is PayloadRequest & { user: User } {\n  return Boolean(req.user)\n}\n\nif (!isAuthenticated(req) && !trusted) throw new Error('auth required to queue')","tryCatchPattern":"try {\n  await payload.jobs.queue({ workflow, data, req })\n} catch (err) {\n  if (err.statusCode === 403) {\n    // authenticate, broaden access.queue, or pass overrideAccess: true\n  } else throw err\n}","preventionTips":["Authenticate service/cron callers, or set jobs.access.queue to permit them.","Reserve overrideAccess: true for trusted in-process queueing only.","Document which principals are allowed to queue in the jobs config."],"tags":["jobs","queues","authorization","local-api"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}