apolloconfig/apollo · error · AccessDeniedException

Change user enabled operation is forbidden

Error message

Change user enabled operation is forbidden

What it means

Thrown by changeUserEnabled for a portal user request when the caller is not a super admin. Only super admins (or tokens with manage-users permission) may enable or disable users.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java:126

    }

    if (userService instanceof SpringSecurityUserService) {
      if (Boolean.TRUE.equals(isCreate)) {
        ((SpringSecurityUserService) userService).create(user);
      } else {
        ((SpringSecurityUserService) userService).update(user);
      }
    } else {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }
    return ResponseEntity.ok().build();
  }

  @Override
  public ResponseEntity<Void> changeUserEnabled(OpenUserDTO openUserDTO, String operator) {
    boolean consumerRequest = requireUserManagementMutationPermission(operator);
    if (!consumerRequest && !unifiedPermissionValidator.isSuperAdmin()) {
      throw new AccessDeniedException("Change user enabled operation is forbidden");
    }
    UserPO user = OpenApiModelConverters.toUserPO(openUserDTO);
    if (userService instanceof SpringSecurityUserService) {
      ((SpringSecurityUserService) userService).changeEnabled(user);
    } else {
      throw new UnsupportedOperationException("change user enabled is unsupported");
    }
    return ResponseEntity.ok().build();
  }

  private void requirePortalUserRequest() {
    if (!isPortalUserIdentity()) {
      throw new AccessDeniedException("Portal user session is required");
    }
  }

  private void requireUserManagementReadPermission() {
    if (UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())) {

View on GitHub (pinned to d95fc18d11)

Solutions

  1. Call the endpoint as a super admin, or use a user token or consumer token granted the manage-users permission.

When it happens

Trigger: Thrown when a caller without the manage-users permission attempts to enable or disable a user account via the OpenAPI.

Common situations: Non-admin token or portal user calls the change-enabled endpoint.

Understand the failure class


AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/9b8daadaf53f098c. Report an issue: GitHub.