{"record":{"id":"b6b484fa565ebbb4","repo":"HumanSignal/label-studio","slug":"action-is-not-allowed-for-the-current-user-actio","errorCode":null,"errorMessage":"Action is not allowed for the current user: {action_id}","messagePattern":"Action is not allowed for the current user: (.+?)","errorType":"validation","errorClass":"PermissionDenied","httpStatus":403,"severity":"error","filePath":"label_studio/data_manager/actions/__init__.py","lineNumber":168,"sourceCode":"            logger.info(e)\n            continue\n\n        for action in module_actions:\n            register_action(**action)\n            logger.debug('Action registered: ' + str(action['entry_point'].__name__))\n\n\ndef perform_action(action_id, project, queryset, user, **kwargs):\n    \"\"\"Perform action using entry point from actions\"\"\"\n    if action_id not in settings.DATA_MANAGER_ACTIONS:\n        raise ValidationError(\"Can't find '\" + action_id + \"' in registered actions\")\n\n    action = settings.DATA_MANAGER_ACTIONS[action_id]\n    check_permission = load_func(settings.DATA_MANAGER_CHECK_ACTION_PERMISSION)\n\n    # check user permissions for this action\n    if not check_permission(user, action, project):\n        raise PermissionDenied(f'Action is not allowed for the current user: {action[\"id\"]}')\n\n    try:\n        result = action['entry_point'](project, queryset, **kwargs)\n    except Exception as e:\n        text = 'Error while perform action: ' + action_id + '\\n' + tb.format_exc()\n        logger.error(text, extra={'sentry_skip': True})\n        raise e\n\n    return result\n\n\ndef get_action_form(action_id, project, user):\n    if action_id not in settings.DATA_MANAGER_ACTIONS:\n        raise ValidationError(\"Can't find '\" + action_id + \"' in registered actions\")\n\n    action = settings.DATA_MANAGER_ACTIONS[action_id]\n    check_permission = load_func(settings.DATA_MANAGER_CHECK_ACTION_PERMISSION)\n","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/HumanSignal/label-studio/blob/0b49e9b53917880baf1dd85d574fe5541a9aafb2/label_studio/data_manager/actions/__init__.py#L150-L186","documentation":"Before executing a Data Manager action, Label Studio invokes the configurable permission check (DATA_MANAGER_CHECK_ACTION_PERMISSION, default checks the action's required permissions for the user on the project). If the check fails, perform_action raises PermissionDenied with the action id. The action is registered but the current user is not allowed to run it on that project.","triggerScenarios":"A non-privileged user (annotator/reviewer role) POSTs to /api/dm/actions for an action requiring e.g. project admin/owner permissions, such as delete_tasks.","commonSituations":"Automations or scripts using a personal token of a low-privileged user; role changes after org restructuring; frontend exposing actions the user cannot execute; custom permission function misconfigured.","solutions":["Re-run the action with credentials of a user having the required role (owner/administrator) on the project","Grant the user the necessary project role or permissions in the organization settings","If using a custom DATA_MANAGER_CHECK_ACTION_PERMISSION, review its logic and the action's 'permissions' entry"],"exampleFix":"// before\nrequests.post(dm_action_url, headers=user_headers, ...)  # annotator token\n// after\nadmin_token = os.environ['LABEL_STUDIO_ADMIN_TOKEN']\nrequests.post(dm_action_url, headers={'Authorization': f'Token {admin_token}'}, ...)","handlingStrategy":"try-catch","validationCode":"user_role = get_current_user_project_role(project_id)  # e.g. via /api/current-user/whoami or org API\nif user_role not in ('owner', 'administrator', 'manager'):\n    raise PermissionError(f'User lacks role required for action {action_id}')","typeGuard":"def can_perform(user, action, required_roles):\n    return user.get('role') in required_roles","tryCatchPattern":"try:\n    perform_action(action_id)\nexcept PermissionDenied:\n    logger.warning(f'Action {action_id} denied for current user; retrying with admin credentials')\n    perform_action_with_admin(action_id)","preventionTips":["Run automation with a service account holding the required project role","Check the action's declared permissions before invoking it","Keep org role assignments updated for users triggering actions"],"tags":["permissions","authorization","data-manager","label-studio"],"backgroundTag":"permission-denied","analyzedSha":"0b49e9b53917880baf1dd85d574fe5541a9aafb2","analyzedAt":"2026-08-29T00:39:52.578Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}