instructure/canvas-lms · error · GraphQL::ExecutionError

not authorized

Error message

not authorized

What it means

After the flag gate, CreateInstitutionalTagCategory requires the current user to have the manage_institutional_tags_create right on the root account; otherwise it raises this GraphQL::ExecutionError. Creating tag categories is limited to users explicitly granted that entitlement.

Solutions

1. Grant manage_institutional_tags_create to the user's role (Account > Permissions / role override).
2. Ensure the GraphQL request is authenticated as the privileged user (valid session/token).
3. Verify the right is being checked on the intended domain_root_account.
4. If tests hit this, seed the user with the right in factories before calling the mutation.

Example fix

// before
user = user_factory # no rights -> raise
// after (spec)
account_admin_user_with_role_changes(user:, role_changes: { manage_institutional_tags_create: true })
# or in console: role.add_permission!(:manage_institutional_tags_create)

# pre-flight
root_account.grants_right?(user, session, :manage_institutional_tags_create) or
raise 'not authorized to create institutional tag categories'

def can_create_tag_category?(root_account, user, session)
  !user.nil? && root_account.grants_right?(user, session, :manage_institutional_tags_create)
end

try {
  await createInstitutionalTagCategory({ variables })
} catch (e) {
  if (e.message === 'not authorized') {
    // request the manage_institutional_tags_create entitlement or re-authenticate
  }
}

When it happens

Trigger: createInstitutionalTagCategory by a user without manage_institutional_tags_create — teachers/students, admins on custom roles without the right, or nil current_user due to missing/invalid session.

Common situations: Service accounts not provisioned with the right; recently added permission not yet granted to admin roles; operating against a different root account than where the right was granted.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• not authorized
• feature flag is disabled
• insufficient permission
• insufficient permission
• insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/cebd85006bcc51af. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/create_institutional_tag_category.rb:33

# details.
#
# You should have received a copy of the GNU Affero General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.
#

# NOTE: Depends on InstitutionalTagCategory model (app/models/institutional_tag_category.rb)

module Mutations
  class CreateInstitutionalTagCategory < BaseMutation
    argument :description, String, required: false
    argument :name,        String, required: true

    field :institutional_tag_category, Types::InstitutionalTagCategoryType, null: true

    def resolve(input:)
      root_account = context[:domain_root_account]
      raise GraphQL::ExecutionError, "feature flag is disabled" unless root_account.feature_enabled?(:institutional_tags)
      raise GraphQL::ExecutionError, "not authorized" unless root_account.grants_right?(current_user, session, :manage_institutional_tags_create)

      category = root_account.institutional_tag_categories.new(
        name: input[:name],
        description: input[:description]
      )

      if category.save
        { institutional_tag_category: category }
      else
        errors_for(category)
      end
    rescue ActiveRecord::RecordInvalid
      errors_for(category)
    rescue ActiveRecord::RecordNotFound
      raise GraphQL::ExecutionError, "not found"
    end
  end
end

View on GitHub (pinned to 1c9f0bb801)