apolloconfig/apollo · error · AccessDeniedException
Change user enabled operation is forbidden
Error message
Change user enabled operation is forbidden
What it means
Thrown by changeUserEnabled for a portal user request when the caller is not a super admin. Only super admins (or tokens with manage-users permission) may enable or disable users.
Source
Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java:126
}
if (userService instanceof SpringSecurityUserService) {
if (Boolean.TRUE.equals(isCreate)) {
((SpringSecurityUserService) userService).create(user);
} else {
((SpringSecurityUserService) userService).update(user);
}
} else {
throw new UnsupportedOperationException("Create or update user operation is unsupported");
}
return ResponseEntity.ok().build();
}
@Override
public ResponseEntity<Void> changeUserEnabled(OpenUserDTO openUserDTO, String operator) {
boolean consumerRequest = requireUserManagementMutationPermission(operator);
if (!consumerRequest && !unifiedPermissionValidator.isSuperAdmin()) {
throw new AccessDeniedException("Change user enabled operation is forbidden");
}
UserPO user = OpenApiModelConverters.toUserPO(openUserDTO);
if (userService instanceof SpringSecurityUserService) {
((SpringSecurityUserService) userService).changeEnabled(user);
} else {
throw new UnsupportedOperationException("change user enabled is unsupported");
}
return ResponseEntity.ok().build();
}
private void requirePortalUserRequest() {
if (!isPortalUserIdentity()) {
throw new AccessDeniedException("Portal user session is required");
}
}
private void requireUserManagementReadPermission() {
if (UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())) {View on GitHub (pinned to d95fc18d11)
Solutions
- Call the endpoint as a super admin, or use a user token or consumer token granted the manage-users permission.
When it happens
Trigger: Thrown when a caller without the manage-users permission attempts to enable or disable a user account via the OpenAPI.
Common situations: Non-admin token or portal user calls the change-enabled endpoint.
Understand the failure class
- Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.
AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14).
Data as JSON: /api/errors/9b8daadaf53f098c.
Report an issue: GitHub.