instructure/canvas-lms · warning · GraphQL::ExecutionError

insufficient permission

Error message

insufficient permission

What it means

The deleteOutcomeProficiency mutation raises "insufficient permission" when the proficiency's context does not grant current_user the :manage_proficiency_scales right. The record exists and is active, but the user cannot modify proficiency scales in that context.

Solutions

1. Grant :manage_proficiency_scales to the user's role in the record's context
2. Authenticate as an account admin with outcome management rights
3. Verify the proficiency belongs to an account you administer
4. Check the account permission matrix for role overrides

Example fix

// before
record.destroy
// after
unless record.context.grants_right?(current_user, :manage_proficiency_scales)
  raise GraphQL::ExecutionError, "insufficient permission"
end
record.destroy

const perms = await query(contextPermissions, { contextId: record.contextId });
if (!perms?.manageProficiencyScales) throw new Forbidden();

function canManageScales(perms) {
  return perms?.manageProficiencyScales === true;
}

try {
  await client.mutate(DELETE_OUTCOME_PROFICIENCY, { id });
} catch (e) {
  if (e.message === "insufficient permission") {
    showPermissionHelp("manage_proficiency_scales");
  } else throw e;
}

When it happens

Trigger: Calling deleteOutcomeProficiency with a valid id while lacking manage_proficiency_scales on record.context — e.g. a teacher attempting account-level proficiency deletion or a sub-account admin on a root-account setting.

Common situations: Non-admin tokens, admins scoped to a different account than the record's context, or role overrides not applied to the caller's enrollment.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• insufficient permission
• Insufficient permission
• insufficient permission
• insufficient permission
• insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/241415461284a6bd. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/delete_outcome_proficiency.rb:38

class Mutations::DeleteOutcomeProficiency < Mutations::BaseMutation
  graphql_name "DeleteOutcomeProficiency"

  # input arguments
  argument :id, ID, required: true

  # the return data if the delete is successful
  field :outcome_proficiency_id, ID, null: false

  def self.outcome_proficiency_id_log_entry(_entry, context)
    context[:deleted_models][:outcome_proficiency].context
  end

  def resolve(input:)
    record_id = GraphQLHelpers.parse_relay_or_legacy_id(input[:id], "OutcomeProficiency")
    record = OutcomeProficiency.active.find_by(id: record_id)
    raise GraphQL::ExecutionError, "Unable to find OutcomeProficiency" if record.nil?
    raise GraphQL::ExecutionError, "insufficient permission" unless record.context.grants_right? current_user, :manage_proficiency_scales

    context[:deleted_models][:outcome_proficiency] = record
    record.destroy
    { outcome_proficiency_id: record.id }
  end
end

View on GitHub (pinned to 1c9f0bb801)