instructure/canvas-lms · warning · GraphQL::ExecutionError

insufficient permission

Error message

insufficient permission

What it means

The deleteOutcomeCalculationMethod mutation raises "insufficient permission" when the record's context (account or course) does not grant the current user :manage_proficiency_calculations. The record exists but the user may not manage its calculation methods.

Solutions

1. Grant the user :manage_proficiency_calculations in the record's context (account/course permissions)
2. Use a token for a user with account-level outcome management rights
3. Verify record.context matches the account you administer
4. Check role overrides in the account's permission matrix

Example fix

// before
record.destroy
// after
unless record.context.grants_right?(current_user, :manage_proficiency_calculations)
  raise GraphQL::ExecutionError, "insufficient permission"
end
record.destroy

const perms = await query(contextPermissions, { contextId: record.contextId });
if (!perms?.manageProficiencyCalculations) throw new Forbidden();

function canManageCalculations(perms) {
  return perms?.manageProficiencyCalculations === true;
}

try {
  await client.mutate(DELETE_OUTCOME_CALCULATION_METHOD, { id });
} catch (e) {
  if (e.message === "insufficient permission") {
    showPermissionHelp("manage_proficiency_calculations");
  } else throw e;
}

When it happens

Trigger: Calling deleteOutcomeCalculationMethod with a valid active id while current_user lacks manage_proficiency_calculations on record.context — e.g. a student or plain teacher on an account-level calculation method.

Common situations: API tokens for non-admin users, admins of a different root account than the record's context, or course-level users attempting account-level proficiency changes.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• insufficient permission
• Insufficient permission
• insufficient permission
• insufficient permission
• insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/59f702d1dc0218fc. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/delete_outcome_calculation_method.rb:38

class Mutations::DeleteOutcomeCalculationMethod < Mutations::BaseMutation
  graphql_name "DeleteOutcomeCalculationMethod"

  # input arguments
  argument :id, ID, required: true

  # the return data if the delete is successful
  field :outcome_calculation_method_id, ID, null: false

  def self.outcome_calculation_method_id_log_entry(_entry, context)
    context[:deleted_models][:outcome_calculation_method].context
  end

  def resolve(input:)
    record_id = GraphQLHelpers.parse_relay_or_legacy_id(input[:id], "OutcomeCalculationMethod")
    record = OutcomeCalculationMethod.active.find_by(id: record_id)
    raise GraphQL::ExecutionError, "Unable to find OutcomeCalculationMethod" if record.nil?
    raise GraphQL::ExecutionError, "insufficient permission" unless record.context.grants_right? current_user, :manage_proficiency_calculations

    context[:deleted_models][:outcome_calculation_method] = record
    record.destroy
    { outcome_calculation_method_id: record.id }
  end
end

View on GitHub (pinned to 1c9f0bb801)