{"record":{"id":"92a1350989462ece","repo":"HumanSignal/label-studio","slug":"you-can-delete-members-only-for-your-current-activ","errorCode":null,"errorMessage":"You can delete members only for your current active organization","messagePattern":"You can delete members only for your current active organization","errorType":"http","errorClass":"PermissionDenied","httpStatus":403,"severity":"error","filePath":"label_studio/organizations/api.py","lineNumber":306,"sourceCode":"\n    def get_serializer_context(self):\n        return {\n            **super().get_serializer_context(),\n            'organization': self.parent_object,\n            'contributed_to_projects': bool_from_request(self.request.GET, 'contributed_to_projects', False),\n        }\n\n    def get(self, request, pk, user_pk):\n        queryset = self.get_queryset()\n        member = get_object_or_404(queryset, user=user_pk)\n        self.check_object_permissions(request, member)\n        serializer = self.get_serializer(member)\n        return Response(serializer.data)\n\n    def delete(self, request, pk=None, user_pk=None):\n        org = self.parent_object\n        if org != request.user.active_organization:\n            raise PermissionDenied('You can delete members only for your current active organization')\n\n        user = get_object_or_404(User, pk=user_pk)\n        member = get_object_or_404(OrganizationMember, user=user, organization=org)\n        if member.deleted_at is not None:\n            raise NotFound('Member not found')\n\n        if member.user_id == request.user.id:\n            return Response({'detail': 'User cannot soft delete self'}, status=status.HTTP_405_METHOD_NOT_ALLOWED)\n\n        return self._delete_member(request, user, member)\n\n    def _delete_member(self, request, user, member):\n        \"\"\"Perform the actual member removal. Override in subclasses to add pre-delete hooks.\"\"\"\n        member.soft_delete()\n        return Response(status=204)  # 204 No Content is a common HTTP status for successful delete requests\n\n\n@method_decorator(","sourceCodeStart":288,"sourceCodeEnd":324,"githubUrl":"https://github.com/HumanSignal/label-studio/blob/0b49e9b53917880baf1dd85d574fe5541a9aafb2/label_studio/organizations/api.py#L288-L324","documentation":"DRF PermissionDenied raised by OrganizationMemberDeleteView.delete when the target organization (resolved from the URL via parent_object) is not the requesting user's currently active organization. Member deletion is only permitted within the session's active org.","triggerScenarios":"DELETE /api/organizations/{pk}/members/{user_pk} (or equivalent) where pk refers to an org other than request.user.active_organization.","commonSituations":"Admin belongs to multiple organizations and the UI/CLI session's active org differs from the target; scripts hitting the endpoint with an org id without switching active organization first; stale session after org switch.","solutions":["Switch the active organization (PATCH active_organization on the user or re-authenticate scoped to the target org) before deleting","Call the delete endpoint with the org id matching your active organization","Ensure the authenticated user is a member/admin of the org and that client state sets it active"],"exampleFix":"// before\ncurl -X DELETE /api/organizations/5/members/42  # active org is 3\n// after\n# switch active org to 5 first, then:\ncurl -X DELETE /api/organizations/5/members/42","handlingStrategy":"try-catch","validationCode":"const orgOk = targetOrgId === currentUser.active_organization;\nif (!orgOk) await switchActiveOrganization(targetOrgId); // before DELETE","typeGuard":null,"tryCatchPattern":"try:\n    delete_member(org_id, user_pk)\nexcept PermissionDenied:\n    set_active_organization(org_id)\n    delete_member(org_id, user_pk)","preventionTips":["Check the session's active organization before org-scoped admin calls","Keep client state's active org in sync with the org ids used in API paths","Ensure the authenticated user is an admin of the target org"],"tags":["permissions","organizations","api","drf"],"backgroundTag":"organization-permission-denied","analyzedSha":"0b49e9b53917880baf1dd85d574fe5541a9aafb2","analyzedAt":"2026-08-29T00:39:52.578Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}