goharbor/harbor · error · errors.Error

DENIED

DENIED

Error message

permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s

What it means

Privilege-escalation guard in CreateRobot: when a robot account creates another robot, isValidPermissionScope checks the new robot's permissions are equal or narrower than the creator's. It fires (naming the creator's scope) when the request attempts to grant the new robot more/broader permissions than the creating robot holds.

Solutions

1. Reduce the new robot's requested permissions to a subset of the creator robot's
2. Create the robot with a user/system admin account instead of a robot account
3. Set the access scope (project) to the same or narrower namespace

When it happens

Trigger: Thrown at src/server/v2.0/handler/robot.go:92 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/3f8f922e75234bb6. Report an issue: GitHub.

Appendix: source

Thrown at src/server/v2.0/handler/robot.go:92

	case *robotSc.SecurityContext:
		if s.User() == nil {
			return rAPI.SendError(ctx, errors.New(nil).WithMessage("invalid security context: empty robot account"))
		}
		if !isValidPermissionScope(params.Robot.Permissions, s.User().Permissions) {
			return rAPI.SendError(ctx, errors.BadRequestError(errors.New("permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions")))
		}

View on GitHub (pinned to 7b2fd08cc5)