apolloconfig/apollo · error · AccessDeniedException

Manage users permission is required

Error message

Manage users permission is required

What it means

Thrown by requireUserManagementReadPermission/requireUserManagementMutationPermission when a user token or consumer token lacks the manage-users permission, or when the auth type is unrecognized.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java:155

  private void requirePortalUserRequest() {
    if (!isPortalUserIdentity()) {
      throw new AccessDeniedException("Portal user session is required");
    }
  }

  private void requireUserManagementReadPermission() {
    if (UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())) {
      return;
    }
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && unifiedPermissionValidator.hasManageUsersPermission()) {
      return;
    }
    if (UserIdentityConstants.CONSUMER.equals(UserIdentityContextHolder.getAuthType())
        && unifiedPermissionValidator.hasManageUsersPermission()) {
      return;
    }
    throw new AccessDeniedException("Manage users permission is required");
  }

  private boolean requireUserManagementMutationPermission(String operator) {
    if (UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())) {
      return false;
    }
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {
      if (!unifiedPermissionValidator.hasManageUsersPermission()) {
        throw new AccessDeniedException("Manage users permission is required");
      }
      return false;
    }
    if (UserIdentityConstants.CONSUMER.equals(UserIdentityContextHolder.getAuthType())) {
      if (!unifiedPermissionValidator.hasManageUsersPermission()) {
        throw new AccessDeniedException("Manage users permission is required");
      }
      operatorResolver.resolve(operator);
      return true;

View on GitHub (pinned to d95fc18d11)

Solutions

1. Grant the calling user token or consumer token the manage-users permission via Apollo portal permission management.
2. Or authenticate as a portal user with sufficient privileges.

When it happens

Trigger: Thrown when the caller lacks the global manage-users permission required for user administration endpoints.

Common situations: Caller is neither super admin nor holder of the manage-users system role.

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/b193ebcc676c8be1. Report an issue: GitHub.