{"id":"21ab48034f47e139","repo":"tiangolo/fastapi","slug":"you-can-only-update-the-item-plumbus","errorCode":null,"errorMessage":"You can only update the item: plumbus","messagePattern":"You can only update the item: plumbus","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"docs_src/bigger_applications/app_an_py310/routers/items.py","lineNumber":35,"sourceCode":"async def read_items():\n    return fake_items_db\n\n\n@router.get(\"/{item_id}\")\nasync def read_item(item_id: str):\n    if item_id not in fake_items_db:\n        raise HTTPException(status_code=404, detail=\"Item not found\")\n    return {\"name\": fake_items_db[item_id][\"name\"], \"item_id\": item_id}\n\n\n@router.put(\n    \"/{item_id}\",\n    tags=[\"custom\"],\n    responses={403: {\"description\": \"Operation forbidden\"}},\n)\nasync def update_item(item_id: str):\n    if item_id != \"plumbus\":\n        raise HTTPException(\n            status_code=403, detail=\"You can only update the item: plumbus\"\n        )\n    return {\"item_id\": item_id, \"name\": \"The great Plumbus\"}\n","sourceCodeStart":17,"sourceCodeEnd":39,"githubUrl":"https://github.com/tiangolo/fastapi/blob/42a41db11f6882807ac3c057b942178d53b97438/docs_src/bigger_applications/app_an_py310/routers/items.py#L17-L39","documentation":"Raised by PUT /items/{item_id} when item_id is not exactly \"plumbus\", returning HTTP 403 Forbidden. It is a business-rule restriction: only the plumbus item may be updated. The route declares responses={403} documenting the case.","triggerScenarios":"PUT /items/{item_id} with any item_id other than \"plumbus\" (e.g. PUT /items/gun).","commonSituations":"Attempting to update a locked/read-only resource; generic update loops that target all ids; misunderstanding that only one item is mutable.","solutions":["Only call PUT /items/plumbus.","Read the route's documented 403 response and branch on it.","If broader updates are needed, extend the handler rather than bypassing the guard."],"exampleFix":"# before\nclient.put(\"/items/gun\", headers=auth)\n# after\nclient.put(\"/items/plumbus\", headers=auth)","handlingStrategy":"validation","validationCode":"# Only attempt to update the allowed item\nif item_id == \"plumbus\":\n    client.put(f\"/items/{item_id}\", headers=auth)","typeGuard":"def is_updatable(item_id: str) -> bool:\n    return item_id == \"plumbus\"","tryCatchPattern":"resp = client.put(f\"/items/{item_id}\", headers=auth)\nif resp.status_code == 403:\n    # this item cannot be updated\n    ...","preventionTips":["Read the route's documented 403 response.","Restrict update UI to allowed items.","Branch on 403 instead of retrying."],"tags":["fastapi","forbidden","authorization","business-rule"],"analyzedSha":"42a41db11f6882807ac3c057b942178d53b97438","analyzedAt":"2026-08-04T19:23:32.007Z","schemaVersion":2}