apolloconfig/apollo · error · AccessDeniedException

Super admin permission is required

Error message

Super admin permission is required

What it means

Thrown by requireSystemRoleReadPermission when a token-based (USER_TOKEN) OpenAPI consumer attempts an operation that requires super-admin privileges but the consumer's associated user is not a super admin. Apollo reserves certain system-wide read operations (e.g. listing all environments, system health checks) for super admins. Token-based callers are checked against isSuperAdmin(); portal-session users are not subject to this guard.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/PermissionController.java:345

        && !unifiedPermissionValidator.hasAssignRolePermission(appId, env, clusterName,
            namespaceName)) {
      throw new AccessDeniedException("Assign role permission is required");
    }
  }

  private void requireAppRoleWritePermission(String appId, String env, String clusterName,
      String namespaceName) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.hasAssignRolePermission(appId, env, clusterName,
            namespaceName)) {
      throw new AccessDeniedException("Assign role permission is required");
    }
  }

  private void requireSystemRoleReadPermission() {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && !unifiedPermissionValidator.isSuperAdmin()) {
      throw new AccessDeniedException("Super admin permission is required");
    }
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

1. Issue the consumer token from a user account that has the super-admin (apollo-admin) role.
2. Verify the user behind the token is listed in portal's super-admin configuration (portal consumer admin users).
3. If you are a portal user (not a token), call the endpoint from the interactive portal session instead of via the OpenAPI token.

Example fix

// before: token issued to non-admin user
Consumer token = consumerService.createConsumer(nonAdminUser, ...);

// after: ensure the consumer's owner is a super admin
Consumer token = consumerService.createConsumer(superAdminUser, ...);

// Before calling a system-level endpoint with a token
if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
    && !unifiedPermissionValidator.isSuperAdmin()) {
  throw new IllegalStateException("Token's user is not a super admin");
}

try {
  // call system-level OpenAPI endpoint
} catch (AccessDeniedException e) {
  if (e.getMessage().contains("Super admin")) {
    // use a token issued from a super-admin account
  }
}

When it happens

Trigger: An OpenAPI token consumer calls a system-level endpoint (e.g. checkSystemHealth, system info) and the token's user is not a super admin in Apollo.

Common situations: The token was issued to a regular portal user rather than an admin account; the admin role was removed from the user after token creation; or a non-admin CI/automation token is being used for an admin-only operation.

Related errors

• Assign role permission is required
• App not found: {appId}
• Create application permission is required
• Access is denied
• Super admin permission is required

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/6e08cbccac3a2357. Report an issue: GitHub.