apolloconfig/apollo · error · AccessDeniedException

Assign role permission is required

Error message

Assign role permission is required

What it means

Thrown by AccessKeyController.requireAccessKeyPermissionForUserToken when the request is authenticated with a USER_TOKEN identity but the user does not have assign-role permission for the specified app and environment. This guards access-key operations (find/enable/disable) so that only users with elevated role-assignment authority can manage access keys. It is a Spring Security AccessDeniedException, resulting in HTTP 403.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AccessKeyController.java:104

  public ResponseEntity<Void> enableAccessKey(String appId, String env, Long accessKeyId,
      Integer mode, String operator) {
    requireAccessKeyPermissionForUserToken(appId, env);
    accessKeyOpenApiService.enableAccessKey(appId, env, accessKeyId, mode,
        operatorResolver.resolve(operator));
    return ResponseEntity.ok().build();
  }

  @Override
  @PreAuthorize(value = "@unifiedPermissionValidator.isAppAdmin(#appId)")
  public ResponseEntity<List<OpenAccessKeyDTO>> findAccessKeys(String appId, String env) {
    requireAccessKeyPermissionForUserToken(appId, env);
    return ResponseEntity.ok(accessKeyOpenApiService.findAccessKeys(appId, env));
  }

  private void requireAccessKeyPermissionForUserToken(String appId, String env) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasAssignRolePermission(appId, env, null, null)) {
      throw new AccessDeniedException("Assign role permission is required");
    }
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

1. Grant the user assign-role permission (app admin) for the target app and environment via the Portal.
2. Switch to using a Consumer token (API token) instead of a user-token if the operation is automated.
3. Verify the env parameter is correct and that the user has permissions in that specific environment.

// Before calling access key APIs with a user-token, check permission
if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {
    if (!unifiedPermissionValidator.hasAssignRolePermission(appId, env, null, null)) {
        throw new IllegalStateException(
            "User token lacks assign-role permission for app " + appId + " env " + env);
    }
}

When it happens

Trigger: Calling findAccessKeys(appId, env) or enableAccessKey(...) with a user-token credential where unifiedPermissionValidator.hasAssignRolePermission(appId, env, null, null) returns false. Only USER_TOKEN identities hit this check; CONSUMER and USER identities bypass it.

Common situations: A user-token (personal access token) lacks the 'AssignRole' permission for the target app/env. The user was recently removed as an app admin but their token is still in use. The environment name does not match any env the user has permissions for.

Related errors

• App not found: {appId}
• Access is denied
• Create application permission is required
• Access is denied
• Access is denied

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/66bb895591f9c375. Report an issue: GitHub.