{"record":{"id":"6bf84cc4ecf9aee4","repo":"langgenius/dify","slug":"you-don-t-have-the-permission-to-access-the-reques","errorCode":null,"errorMessage":"You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.","messagePattern":"You don't have the permission to access the requested resource\\. It is either read-protected or not readable by the server\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"api/controllers/console/datasets/datasets_document.py","lineNumber":1245,"sourceCode":"    @with_current_tenant_id\n    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)\n    @with_session\n    def patch(\n        self,\n        session: Session,\n        current_tenant_id: str,\n        current_user: Account,\n        dataset_id: UUID,\n        document_id: UUID,\n        action: Literal[\"pause\", \"resume\"],\n    ):\n        dataset_id_str = str(dataset_id)\n        document_id_str = str(document_id)\n        document = self.get_document(session, dataset_id_str, document_id_str, current_user, current_tenant_id)\n\n        # The role of the current user in the ta table must be admin, owner, dataset_operator, or editor\n        if not current_user.is_dataset_editor:\n            raise Forbidden()\n\n        match action:\n            case \"pause\":\n                if document.indexing_status != IndexingStatus.INDEXING:\n                    raise InvalidActionError(\"Document not in indexing state.\")\n\n                document.paused_by = current_user.id\n                document.paused_at = naive_utc_now()\n                document.is_paused = True\n\n            case \"resume\":\n                if document.indexing_status not in {IndexingStatus.PAUSED, IndexingStatus.ERROR}:\n                    raise InvalidActionError(\"Document not in paused or error state.\")\n\n                document.paused_by = None\n                document.paused_at = None\n                document.is_paused = False\n","sourceCodeStart":1227,"sourceCodeEnd":1263,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/datasets/datasets_document.py#L1227-L1263","documentation":"Flask-RESTful Forbidden (HTTP 403, default message shown) raised by PATCH /console/api/datasets/{dataset_id}/documents/{document_id}/processing/{pause|resume} when current_user.is_dataset_editor is False (datasets_document.py:1244). Only admin, owner, dataset_operator, or editor roles may pause/resume processing.","triggerScenarios":"A viewer, app-reviewer, or member-with-no-role user calls processing pause or resume; a service API key lacking the dataset editor scope is used against the console route.","commonSituations":"New teammate added as viewer; RBAC roles downgraded; console route hit by an integration that uses a non-editor token.","solutions":["Have an owner/admin grant the caller a dataset-editor-capable role (admin, owner, editor, or dataset_operator).","Use an account whose role satisfies is_dataset_editor for pause/resume actions.","Move the integration to the service API surface if it only has service-level credentials."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Pre-flight: confirm the caller has an editor-capable role\nme = console.get_current_user()\nif me.get(\"role\") not in {\"owner\", \"admin\", \"editor\", \"dataset_operator\"}:\n    raise PermissionError(\"Only dataset editors may pause/resume processing.\")","typeGuard":"def is_dataset_editor(user: dict) -> bool:\n    return user.get(\"is_dataset_editor\") is True or user.get(\"role\") in {\"owner\", \"admin\", \"editor\", \"dataset_operator\"}","tryCatchPattern":"try:\n    console.process_document(dataset_id, document_id, action=\"pause\")\nexcept HTTPError as e:\n    if e.response.status_code == 403:\n        notify_user(\"You need an editor role to pause or resume this document.\")\n    else:\n        raise","preventionTips":["Gate pause/resume UI controls on the user's editor role.","Use service API routes for integrations that only hold service-level credentials."],"tags":["rbac","forbidden","permissions","knowledge"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}