infiniflow/ragflow · warning · ApiPermissionError

The calling user does not have permission

Error message

The calling user does not have permission

What it means

An atlassian ApiPermissionError raised by OnyxConfluence.get_mobile_parameters (a monkey-patched Confluence client method) when GET rest/api/user/current returns HTTP 403. The patch maps 403 to a permission error with this message, preserving the original HTTPError as reason. It surfaces during user-lookup helpers (e.g. get_user_email_from_username__server) that resolve usernames to emails on Confluence Server.

Source

Thrown at common/data_source/confluence_connector.py:790

        Implements a method that isn't in the third party client.

        Get information about the current user
        :param expand: OPTIONAL expand for get status of user.
                Possible param is "status". Results are "Active, Deactivated"
        :return: Returns the user details
        """

        from atlassian.errors import ApiPermissionError  # type:ignore

        url = "rest/api/user/current"
        params = {}
        if expand:
            params["expand"] = expand
        try:
            response = self.get(url, params=params)
        except HTTPError as e:
            if e.response.status_code == 403:
                raise ApiPermissionError("The calling user does not have permission", reason=e)
            raise
        return response


def get_user_email_from_username__server(confluence_client: OnyxConfluence, user_name: str) -> str | None:
    global _USER_EMAIL_CACHE
    if _USER_EMAIL_CACHE.get(user_name) is None:
        try:
            response = confluence_client.get_mobile_parameters(user_name)
            email = response.get("email")
        except Exception:
            logging.warning(f"failed to get confluence email for {user_name}")
            # For now, we'll just return None and log a warning. This means
            # we will keep retrying to get the email every group sync.
            email = None
            # We may want to just return a string that indicates failure so we don't
            # keep retrying
            # email = f"FAILED TO GET CONFLUENCE EMAIL FOR {user_name}"

View on GitHub (pinned to 554fb1133a)

Solutions

1. Use credentials of a user with permission to view user profiles (Confluence admin, or grant 'View user profiles' global permission)
2. If the instance enforces SSO, create and use a Personal Access Token (Server 7.9+) instead of basic auth
3. Check any reverse proxy/WAF in front of Confluence for 403 rules on rest/api/user/current
4. Catch ApiPermissionError where user-email enrichment is optional, and degrade to indexing without emails instead of failing the run

Example fix

// before
response = confluence_client.get_mobile_parameters(user_name)
email = response.get('email')
// after
from atlassian.errors import ApiPermissionError
try:
    response = confluence_client.get_mobile_parameters(user_name)
    email = response.get('email')
except ApiPermissionError:
    logging.warning('no profile-view permission; indexing without email for %s', user_name)
    email = None

# preflight: confirm the token can view profiles before enrichment runs
resp = confluence_client.get('rest/api/user/current')
if resp is None:
    disable_email_enrichment = True

from atlassian.errors import ApiPermissionError
try:
    email = get_user_email_from_username__server(client, user_name)
except ApiPermissionError:
    logging.warning('profile view denied; continuing without email for %s', user_name)
    email = None

When it happens

Trigger: Calling get_user_current/get_mobile_parameters with credentials whose user lacks permission to view the current-user or target-user profile: a read-only service account, a user restricted by space-level permissions, or Confluence Server global permissions denying profile viewing. Also 403 from a reverse proxy/WAF in front of Confluence, and SSO-only instances rejecting PAT/basic auth.

Common situations: Personal Access Token created by a low-privilege Server user used for document ingestion (fetching document metadata triggers user lookups); SSO/SAML enforcement making basic auth return 403 on user endpoints; reverse-proxy IP allowlists blocking the indexing host.

Related errors

• Insufficient permissions to access Confluence resources (HTT
• main() must return a value. Use null for an empty result.
• Insufficient permissions to access Bitbucket workspace (HTTP
• Your GitHub token does not have sufficient permissions for t
• Jira token does not have permission to access the requested

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/5fbc02e121ee068c. Report an issue: GitHub.