dgraph-io/dgraph · error

Enable ACL to use this mutation

Error message

Enable ACL to use this mutation

What it means

This guard middleware wraps GraphQL mutations and rejects them when ACL (Access Control Lists) is not enabled on the cluster (x.WorkerConfig.AclEnabled is false). Mutations guarded by AclOnlyMW4Mutation require ACL so that permission records exist; without ACL the operation is refused. The resolver returns an empty result with the error and a false 'ok', short-circuiting execution.

Source

Thrown at graphql/resolve/middlewares.go:221

			return resolved, false
		}
		return resolver.Resolve(ctx, mutation)
	})
}

func LoggingMWMutation(resolver MutationResolver) MutationResolver {
	return MutationResolverFunc(func(ctx context.Context, mutation schema.Mutation) (*Resolved,
		bool) {
		glog.Infof("GraphQL admin mutation. Name =  %v", mutation.Name())
		return resolver.Resolve(ctx, mutation)
	})
}

func AclOnlyMW4Mutation(resolver MutationResolver) MutationResolver {
	return MutationResolverFunc(func(ctx context.Context, mutation schema.Mutation) (*Resolved,
		bool) {
		if !x.WorkerConfig.AclEnabled {
			return EmptyResult(mutation, errors.New("Enable ACL to use this mutation")), false
		}
		return resolver.Resolve(ctx, mutation)
	})
}

View on GitHub (pinned to 759e242be6)

Solutions

1. Enable ACL on the cluster (restart Zero/Alpha with ACL flags and a valid enterprise license if needed)
2. Use a mutation not guarded by AclOnlyMW4Mutation for non-ACL setups
3. Verify x.WorkerConfig.AclEnabled is true on the node serving the request
4. If ACL was just enabled, confirm config was reloaded/restarted across all nodes

Example fix

// before
dgraph zero --my=... # no ACL flags
// after
dgraph zero --my=... --acl-access-ttl=24h --acl-secret-file=hub_enc

// client: check cluster config / docs before sending ACL-guarded mutations
if (!clusterConfig.aclEnabled) {
  return Promise.reject(new Error('Enable ACL to use this mutation'));
}

try {
  await graphqlMutation(mutation);
} catch (err) {
  if (err.message.includes('Enable ACL to use this mutation')) {
    // surface a clear ops message: enable ACL or use an unguarded mutation
  }
}

When it happens

Trigger: Sending any guarded mutation (e.g. adding/dropping data or permission-related admin mutations) while the Dgraph cluster runs without ACL enabled in its configuration.

Common situations: Running a local/dev cluster without --acl options (or without the enterprise license) then attempting enterprise-only mutations; forgetting to enable ACL after upgrading; misconfigured Zero/Alpha flags so AclEnabled is false on some nodes.

Related errors

• only guardians are allowed to drop all data, but the current
• connection string cannot be empty
• bulk output directory cannot be empty
• failed to open BadgerDB at [%v]: %v
• cannot force namespace %#x when provided creds are not of su

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/628bfe5f7c796233. Report an issue: GitHub.