gotify/server · error

you are not allowed to access this api

Error message

you are not allowed to access this api

What it means

Returned by CreateUser when the caller lacks permission to create users. A non-admin (or anonymous) requester is only tolerated when self-registration is enabled (a.Registration); otherwise the API aborts with 401 (anonymous) or 403 (authenticated non-admin). It is an authorization gate, evaluated before any user record is written.

Source

Thrown at api/user.go:226

		}

		var requestedBy *model.User
		uid := auth.TryGetUserID(ctx)
		if uid != nil {
			requestedBy, err = a.DB.GetUserByID(*uid)
			if err != nil {
				ctx.AbortWithError(http.StatusInternalServerError, fmt.Errorf("could not get user: %s", err))
				return
			}
		}

		if requestedBy == nil || !requestedBy.Admin {
			status := http.StatusUnauthorized
			if requestedBy != nil {
				status = http.StatusForbidden
			}
			if !a.Registration {
				ctx.AbortWithError(status, errors.New("you are not allowed to access this api"))
				return
			}
			if internal.Admin {
				ctx.AbortWithError(status, errors.New("you are not allowed to create an admin user"))
				return
			}
		}

		if existingUser == nil {
			if success := successOrAbort(ctx, 500, a.DB.CreateUser(internal)); !success {
				return
			}
			if err := a.UserChangeNotifier.fireUserAdded(internal.ID); err != nil {
				ctx.AbortWithError(500, err)
				return
			}
			ctx.JSON(200, toExternalUser(internal))
		} else {

View on GitHub (pinned to 14bfc25627)

Solutions

1. Authenticate the request as an admin user (Basic auth with an account whose Admin=true)
2. Enable registration (config flag mapped to a.Registration) if self-service signup is intended
3. Ensure the admin Authorization header is not stripped by proxies/client code
4. For self-registration, do not attempt to set the admin flag and call the register route with registration enabled

Example fix

// before
curl -X POST https://host/api/users -d '{"username":"bob"}'  // 403, non-admin
// after
curl -X POST https://host/api/users -u 'admin:s3cret' -d '{"username":"bob"}'

// client-side pre-check before calling createUser
if (!isAdminAccount(currentUser) && !registrationEnabled) {
  throw new Error('user creation requires an admin account (registration is disabled)');
}

function canCreateUsers(requester) {
  return requester != null && requester.admin === true;
}

try {
  await api.createUser(payload, { auth: adminCredentials });
} catch (e) {
  if (e.status === 401 || e.status === 403) { log('not permitted: use admin credentials or enable registration'); }
  else { throw e; }
}

When it happens

Trigger: POST /api/users without admin credentials while registration is disabled; a logged-in non-admin attempting to create an arbitrary user; unauthenticated request when a.Registration is false; admin flag sent in the payload by a non-admin caller with registration disabled.

Common situations: CI scripts calling the user-creation API with a service token that is not an admin; disabling open registration after previously allowing it, breaking old signup calls; forgetting to pass the admin session when automating user provisioning; reverse proxy dropping the Authorization header so the request is seen as anonymous.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• you are not allowed to create an admin user
• no client auth provided
• cannot delete last admin
• cannot delete internal application
• client not found

AI-assisted analysis of gotify/server@14bfc25627 (2026-09-05). Data as JSON: /api/errors/3092fd96492108be. Report an issue: GitHub.