{"record":{"id":"6e08cbccac3a2357","repo":"apolloconfig/apollo","slug":"super-admin-permission-is-required-6e08cb","errorCode":null,"errorMessage":"Super admin permission is required","messagePattern":"Super admin permission is required","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/PermissionController.java","lineNumber":345,"sourceCode":"        && !unifiedPermissionValidator.hasAssignRolePermission(appId, env, clusterName,\n            namespaceName)) {\n      throw new AccessDeniedException(\"Assign role permission is required\");\n    }\n  }\n\n  private void requireAppRoleWritePermission(String appId, String env, String clusterName,\n      String namespaceName) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && !unifiedPermissionValidator.hasAssignRolePermission(appId, env, clusterName,\n            namespaceName)) {\n      throw new AccessDeniedException(\"Assign role permission is required\");\n    }\n  }\n\n  private void requireSystemRoleReadPermission() {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n        && !unifiedPermissionValidator.isSuperAdmin()) {\n      throw new AccessDeniedException(\"Super admin permission is required\");\n    }\n  }\n}\n","sourceCodeStart":327,"sourceCodeEnd":349,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/PermissionController.java#L327-L349","documentation":"Thrown by requireSystemRoleReadPermission when a token-based (USER_TOKEN) OpenAPI consumer attempts an operation that requires super-admin privileges but the consumer's associated user is not a super admin. Apollo reserves certain system-wide read operations (e.g. listing all environments, system health checks) for super admins. Token-based callers are checked against isSuperAdmin(); portal-session users are not subject to this guard.","triggerScenarios":"An OpenAPI token consumer calls a system-level endpoint (e.g. checkSystemHealth, system info) and the token's user is not a super admin in Apollo.","commonSituations":"The token was issued to a regular portal user rather than an admin account; the admin role was removed from the user after token creation; or a non-admin CI/automation token is being used for an admin-only operation.","solutions":["Issue the consumer token from a user account that has the super-admin (apollo-admin) role.","Verify the user behind the token is listed in portal's super-admin configuration (portal consumer admin users).","If you are a portal user (not a token), call the endpoint from the interactive portal session instead of via the OpenAPI token."],"exampleFix":"// before: token issued to non-admin user\nConsumer token = consumerService.createConsumer(nonAdminUser, ...);\n\n// after: ensure the consumer's owner is a super admin\nConsumer token = consumerService.createConsumer(superAdminUser, ...);","handlingStrategy":"validation","validationCode":"// Before calling a system-level endpoint with a token\nif (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())\n    && !unifiedPermissionValidator.isSuperAdmin()) {\n  throw new IllegalStateException(\"Token's user is not a super admin\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  // call system-level OpenAPI endpoint\n} catch (AccessDeniedException e) {\n  if (e.getMessage().contains(\"Super admin\")) {\n    // use a token issued from a super-admin account\n  }\n}","preventionTips":["Maintain a dedicated super-admin account for API automation tokens.","Never use regular-user tokens for admin-only endpoints.","Audit token ownership to confirm admin status before deployment."],"tags":["permission","openapi","authorization","super-admin","access-denied"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}