{"record":{"id":"cdc8f85b61a82c85","repo":"n8n-io/n8n","slug":"403-cdc8f8","errorCode":"403","errorMessage":"You do not have permission to update provider connections","messagePattern":"You do not have permission to update provider connections","errorType":"exception","errorClass":"ForbiddenError","httpStatus":403,"severity":"error","filePath":"packages/cli/src/credentials/credentials.service.ts","lineNumber":1038,"sourceCode":"\t\t\tname: string;\n\t\t\ttype: string;\n\t\t\tdata: ICredentialDataDecryptedObject;\n\t\t},\n\t): Promise<ICredentialsDb> {\n\t\tconst encrypted = await this.createEncryptedData(credential);\n\t\tawait this.externalHooks.run(`credentials.${event}`, [encrypted]);\n\t\treturn encrypted;\n\t}\n\n\tasync updateInstanceCredential(\n\t\tuser: User,\n\t\tcredentialId: string,\n\t\tdata: CredentialRequest.CredentialProperties,\n\t\tctx: OperationContext,\n\t\toptions: InstanceCredentialWriteOptions = {},\n\t): Promise<CredentialsEntity> {\n\t\tif (!hasGlobalScope(user, 'credential:manageInstance')) {\n\t\t\tthrow new ForbiddenError('You do not have permission to update provider connections');\n\t\t}\n\n\t\tconst credential = await this.credentialsRepository.findInstanceCredentialById(\n\t\t\tcredentialId,\n\t\t\tctx,\n\t\t);\n\t\tif (!credential) {\n\t\t\tthrow new NotFoundError(`Credential with ID \"${credentialId}\" could not be found.`);\n\t\t}\n\n\t\tconst prepared = await this.prepareUpdateData(user, data, credential, {\n\t\t\toperationContext: ctx,\n\t\t});\n\t\tif (prepared.type !== credential.type) {\n\t\t\tthrow new BadRequestError(\n\t\t\t\t'Provider connection type cannot be changed. Create a new connection instead.',\n\t\t\t);\n\t\t}","sourceCodeStart":1020,"sourceCodeEnd":1056,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/credentials/credentials.service.ts#L1020-L1056","documentation":"Thrown by CredentialsService.updateInstanceCredential when hasGlobalScope(user, 'credential:manageInstance') is false. Instance (provider) credentials are written through a dedicated path that requires the global instance-management scope; ordinary project-level credential:update is insufficient.","triggerScenarios":"Calling the instance-credential update path (e.g. provider connections management) as a non-admin user without the global 'credential:manageInstance' scope.","commonSituations":"A project member or custom role attempts to edit an instance/provider connection. Admin-only endpoint called from a low-privilege session token.","solutions":["Grant the user/role the global 'credential:manageInstance' scope (admin/owner action).","Perform the update as an admin user with instance-management rights.","Route the change through project credentials if instance-level management is not intended for this user."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!user.globalScopes?.includes('credential:manageInstance')) {\n  throw new Error('User cannot manage instance credentials — requires admin.');\n}\nawait updateInstanceCredential(user, id, data, ctx);","typeGuard":"function canManageInstance(user: { globalScopes?: string[] }): boolean {\n  return !!user?.globalScopes?.includes('credential:manageInstance');\n}","tryCatchPattern":null,"preventionTips":["Restrict the instance-credential management UI to admins.","Grant credential:manageInstance only to dedicated operator roles.","Do not expose instance-credential endpoints to project-member tokens."],"tags":["credentials","rbac","instance-credentials","permissions"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}