{"record":{"id":"feb620eab796ca61","repo":"vxcontrol/pentagi","slug":"you-do-not-have-permission-to-execute-the-api","errorCode":null,"errorMessage":"You do not have permission to execute the api.","messagePattern":"You do not have permission to execute the api\\.","errorType":"console","errorClass":null,"httpStatus":403,"severity":"error","filePath":"frontend/src/lib/axios.ts","lineNumber":126,"sourceCode":"\n                    if (currentPath !== routes.login()) {\n                        window.location.href = routes.login(currentPath);\n                    }\n\n                    break;\n                }\n\n                case 403: {\n                    const responseData = err.response?.data as undefined | { code?: string };\n\n                    if (\n                        responseData?.code === 'AuthRequired' ||\n                        responseData?.code === 'NotPermitted' ||\n                        responseData?.code === 'PrivilegesRequired' ||\n                        responseData?.code === 'AdminRequired' ||\n                        responseData?.code === 'SuperRequired'\n                    ) {\n                        Log.warn('You do not have permission to execute the api.');\n                        localStorage.removeItem(AUTH_STORAGE_KEY);\n\n                        const currentPath = window.location.pathname;\n\n                        if (currentPath !== routes.login()) {\n                            window.location.href = routes.login(currentPath);\n                        }\n                    } else {\n                        Log.warn(err.response?.data);\n                    }\n\n                    break;\n                }\n\n                case 409: {\n                    // Conflict is an expected outcome for operations with an\n                    // overwrite workflow (move, copy, etc.).  The calling hook\n                    // handles it and shows a prompt; there is nothing to log.","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/frontend/src/lib/axios.ts#L108-L144","documentation":"The same interceptor (frontend/src/lib/axios.ts:126) recognizes backend JSON error codes AuthRequired, NotPermitted, PrivilegesRequired, AdminRequired and SuperRequired. When a failing response carries one of these codes it logs 'You do not have permission to execute the api.', clears the stored auth data (AUTH_STORAGE_KEY), and redirects to the login page with the current path preserved.","triggerScenarios":"Any API call whose error response body has responseData.code set to one of the five auth codes — typically a 403/401 payload from the backend signaling that the authenticated principal lacks the privileges (user vs admin vs super-admin) required by the endpoint.","commonSituations":"A regular user opening an admin-only settings page whose queries then fail; an API token created with insufficient scopes calling a privileged endpoint; role downgraded server-side while the stale client session persists; accessing a GraphQL mutation restricted to AdminRequired/SuperRequired roles.","solutions":["Log in with an account that has the required role (admin/super-admin) for the endpoint — the redirect flow returns you to the page after re-authentication.","Regenerate the API token with the necessary permissions/scopes if the call uses Bearer-token auth.","Confirm on the backend which error code the endpoint returns and adjust the UI to hide features the current role cannot use.","If you believe access should be granted, have an administrator update the user's role/privileges on the server."],"exampleFix":"// before\nexport const SomeSetting = () => { ... }\n// after (guard admin-only UI so the call is never made without the role)\nif (!user.isAdmin) return <AccessDenied />;\nreturn <SomeSetting />;","handlingStrategy":"type-guard","validationCode":"const canCall = (user: User, needed: 'admin' | 'super') =>\n  needed === 'admin' ? user.isAdmin : user.isSuperAdmin;\nif (!canCall(user, 'admin')) throw new Error('NotPermitted: admin role required');","typeGuard":"function isPermissionError(e: unknown): e is AxiosError {\n  if (!axios.isAxiosError(e)) return false;\n  const code = (e.response?.data as any)?.code;\n  return ['AuthRequired','NotPermitted','PrivilegesRequired','AdminRequired','SuperRequired'].includes(code);\n}","tryCatchPattern":"try {\n  await api.post('/admin/setting', payload);\n} catch (err) {\n  if (isPermissionError(err)) {\n    Log.warn('Missing privileges for this operation');\n    return; // or surface a permission-denied UI state\n  }\n  throw err;\n}","preventionTips":["Gate admin-only routes/components behind the user's role before issuing privileged requests.","Keep backend error codes (AuthRequired, NotPermitted, ...) documented and in sync with the interceptor's list.","Provision API tokens with the correct scopes for the operations the client performs.","Re-fetch the user's role after changes instead of relying on a stale cached session."],"tags":["auth","permissions","http-403","rbac","axios"],"backgroundTag":"insufficient-permissions","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}