instructure/canvas-lms · error · GraphQL::ExecutionError

Insufficient permissions to create group set

Error message

Insufficient permissions to create group set

What it means

The CreateGroupSet GraphQL mutation raises this when check_group_context_rights fails: the current user lacks the required 'add' rights (adjusted for collaborative/non-collaborative group sets) on the target course or group context. No GroupCategory is built; the mutation aborts with this GraphQL::ExecutionError before any save is attempted.

Solutions

1. Log in / issue the request as a user with group-set creation rights on the target course or group (teacher, designer, or admin as configured).
2. Grant the role the required permission (course/group 'add' group categories) via Account > Permissions or a custom role.
3. Verify the context passed in the mutation is the intended one; the user may have rights on a different course/group.
4. Check whether check_group_context_rights differentiates collaborative vs non_collaborative and request the variant the user is allowed to create.
5. If the user should have rights, inspect GroupPermissionHelper logic and the context's role overrides for why rights are denied.

Example fix

// before
mutation {
  createGroupSet(input: {contextId: "123", contextType: "Course", name: "Projects"}) { ... }
}
// after — ensure the acting user has permission, e.g. run as admin token or grant role first
POST /api/graphql with access token of a teacher/admin user on course 123

# before calling the mutation, client-side/admin-side check
rights = course.grants_right?(user, session, :create_group_sets) ||
         group.grants_right?(user, session, :create_group_sets)
raise 'user cannot create group sets in this context' unless rights

def can_create_group_set?(context, user, non_collaborative: false)
  context.present? && user.present? &&
    GroupPermissionHelper.check_group_context_rights(
      context: context, current_user: user,
      action_category: :add, non_collaborative: non_collaborative
    )
end

begin
  result = Mutations::CreateGroupSet.graphql_definition; # execute mutation
rescue GraphQL::ExecutionError => e
  handle_permission_denied if e.message == 'Insufficient permissions to create group set'
end

When it happens

Trigger: Calling mutation createGroupSet with a course/group context where the current user does not hold permission to add group sets — e.g. a student or teacher in a course where only admins may create group sets, or a user lacking rights for the non_collaborative variant requested.

Common situations: API integrations calling the mutation with a token of a low-privileged user; enrolling users without the 'add group sets' role entitlement; testing against a context where group creation is admin-restricted; passing non_collaborative when the user only has collaborative-creation rights (or vice versa).

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• feature flag is disabled
• Insufficient permissions
• not authorized
• not authorized
• A maximum of 50 assessees can be provided at once

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/2d1ed87afa0e991b. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/create_group_set.rb:56

      options = {
        name: input[:name],
        self_signup: input[:self_signup],
        auto_leader_type: input[:auto_leader_type],
        group_limit: input[:group_limit],
        non_collaborative: input[:non_collaborative],
        create_group_count: get_group_count(input[:create_group_count]),
        create_group_member_count: input[:create_group_member_count],
        group_by_section: input[:group_by_section],
        enable_auto_leader: input[:enable_auto_leader],
        enable_self_signup: input[:enable_self_signup],
        restrict_self_signup: input[:restrict_self_signup],
        assign_async: input[:assign_async],
        assign_unassigned_members: input[:assign_unassigned_members],
      }

      populate_group_category(options)
    else
      raise GraphQL::ExecutionError, "Insufficient permissions to create group set"
    end

    { group_set: @group_category }
  end

  # Private
  def populate_group_category(options)
    @group_category = GroupCategories::ParamsPolicy.new(@group_category, @context).populate_with(options)

    SubmissionLifecycleManager.with_executing_user(@current_user) do
      unless @group_category.save
        raise GraphQL::ExecutionError, "Unable to create group set"
      end
    end
  end

  def get_group_count(count)
    if count && count > 0

View on GitHub (pinned to 1c9f0bb801)