{"record":{"id":"f0a6d36dfe3f732b","repo":"hcengineering/platform","slug":"not-an-owner-of-workspace-f0a6d3","errorCode":null,"errorMessage":"Not an owner of workspace","messagePattern":"Not an owner of workspace","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"services/export/pod-export/src/server.ts","lineNumber":326,"sourceCode":"\n      const decodedToken = decodeToken(token)\n      if (decodedToken.extra?.readonly !== undefined) {\n        throw new ApiError(403, 'Forbidden')\n      }\n      const isAdmin: boolean = decodedToken.extra?.admin === 'true'\n\n      const accountClient = getClient(envConfig.AccountsUrl, token)\n\n      try {\n        const info = await accountClient.getLoginWithWorkspaceInfo()\n        const winfo = info.workspaces[decodedToken.workspace]\n        if (!isAdmin) {\n          if (winfo === undefined) {\n            res.status(401).end('Invalid workspace')\n            return\n          } else {\n            if (winfo.role !== AccountRole.Owner) {\n              res.status(401).end('Not an owner of workspace')\n              return\n            }\n          }\n        }\n      } catch (err: any) {\n        res.status(401).end('Invalid workspace')\n        return\n      }\n\n      const sysToken = generateToken(systemAccountUuid, decodedToken.workspace, {\n        service: 'export'\n      })\n\n      const platformClient = await createPlatformClient(sysToken)\n      const account = decodedToken.account\n\n      const txOperations = new TxOperations(platformClient, socialId)\n","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/services/export/pod-export/src/server.ts#L308-L344","documentation":"Same export route's role check: when the token's workspace exists in the accounts service but the caller's role in that workspace is not AccountRole.Owner and the token is not an admin token, the route responds 401 'Not an owner of workspace'. Exporting into another workspace is restricted to owners.","triggerScenarios":"POST to the export-to-workspace route with a valid, non-admin token whose workspace role (info.workspaces[decodedToken.workspace].role) is Member/Guest/etc. rather than Owner.","commonSituations":"A regular member trying to import/export data into a team workspace, service integrations using a non-owner account's token, or role downgrades after the token was issued.","solutions":["Ask a workspace Owner (or an admin token) to perform the export.","Have an existing owner elevate the account's role to Owner in the workspace settings.","Confirm the role server-side; a cached account role can lag after promotion — re-login for a fresh token.","If this is an automated job, provision a dedicated owner/service account for it."],"exampleFix":"// before (member token)\nawait exportApi.export(memberToken, targetWs)\n// after (owner token)\nconst ownerLogin = await loginAs(ownerAccount)\nawait exportApi.export(ownerLogin.token, targetWs)","handlingStrategy":"validation","validationCode":"// verify role before calling export\nconst info = await accountClient.getLoginWithWorkspaceInfo()\nconst winfo = info.workspaces[targetWorkspace]\nif (winfo && winfo.role !== 'Owner') {\n  throw new Error('export requires Owner role in the target workspace')\n}","typeGuard":"function isOwner(winfo: { role: string } | undefined): boolean {\n  return winfo?.role === 'Owner'\n}","tryCatchPattern":"const res = await exportApi.exportToWorkspace(token, payload)\nif (res.status === 401 && (await res.text()) === 'Not an owner of workspace') {\n  throw new Error('current account is not an Owner — request elevation or use an owner token')\n}","preventionTips":["Check the account's workspace role before initiating cross-workspace exports","Provision a dedicated owner/service account for automated exports","Refresh tokens after role changes so claims are current","Surface role requirements in tooling UI before the call is made"],"tags":["auth","http","authorization","rbac"],"backgroundTag":"insufficient-role-permissions","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}