{"record":{"id":"7fd71f931c90413e","repo":"passbolt/passbolt_api","slug":"only-administrators-can-add-new-users","errorCode":null,"errorMessage":"Only administrators can add new users.","messagePattern":"Only administrators can add new users\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"src/Controller/Users/UsersAddController.php","lineNumber":54,"sourceCode":"    public function initialize(): void\n    {\n        parent::initialize();\n        $this->Users = $this->fetchTable('Users');\n    }\n\n    /**\n     * User add action (admin only)\n     *\n     * @throws \\App\\Error\\Exception\\ValidationException if user data does not validate\n     * @throws \\Exception\n     * @return void\n     */\n    public function addPost()\n    {\n        $this->assertJson();\n\n        if ($this->User->role() !== Role::ADMIN) {\n            throw new ForbiddenException(__('Only administrators can add new users.'));\n        }\n        $data = $this->request->getData();\n        $user = $this->Users->register($data, $this->User->getAccessControl());\n        $user = $this->Users->findView($user->id, Role::ADMIN)->first();\n        $msg = __('The user was successfully added. This user now need to complete the setup.');\n        $this->success($msg, $user);\n    }\n}\n","sourceCodeStart":36,"sourceCodeEnd":63,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Users/UsersAddController.php#L36-L63","documentation":"Thrown by UsersAddController::addPost when a non-admin attempts to POST /users.json to register a new user. User creation is admin-only; the check compares the authenticated user's role against Role::ADMIN before invoking Users->register().","triggerScenarios":"POST /users.json from a logged-in 'user' or 'guest' role account, or with no/invalid authentication where the resolved role is not ADMIN.","commonSituations":"Scripts using a regular user's API key to provision accounts; expired admin session downgrading the role; self-registration attempts (passbolt requires admin-invited setup).","solutions":["Authenticate the request with an administrator account's credentials.","If you need non-admin signup, that is not supported — invite users via an admin instead.","Verify the token/session used is still a valid admin session (re-login)."],"exampleFix":"// before\nawait api.post('/users.json', newUser, { headers: { 'X-User-Token': userToken } }); // user role\n// after\nawait api.post('/users.json', newUser, { headers: { 'X-User-Token': adminToken } });","handlingStrategy":"validation","validationCode":"const me = await api.get('/users/me.json');\nif (me.body.role.name !== 'admin') throw new Error('user creation requires an admin account');","typeGuard":"function isAdmin(session) { return session?.role?.name === 'admin' || session?.role === 'admin'; }","tryCatchPattern":"try { await api.post('/users.json', body); } catch (e) { if (e.status === 403 && /administrators can add/.test(e.message)) { switchToAdminCredentials(); } else throw e; }","preventionTips":["Store admin credentials separately for provisioning scripts","Check GET /users/me.json role before admin-only calls","Remember user onboarding is invite-only — do not attempt self-registration"],"tags":["authorization","users","forbidden","admin"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}