instructure/canvas-lms · error · GraphQL::ExecutionError

not authorized

Error message

not authorized

What it means

After the feature-flag check, updateInstitutionalTagArchivedState verifies the acting user holds :manage_institutional_tags_edit on the root account; otherwise it raises "not authorized". The archive/restore action never runs without this right.

Solutions

1. Assign the user an account role that includes :manage_institutional_tags_edit (Account > Permissions).
2. Verify with root_account.grants_right?(user, session, :manage_institutional_tags_edit) in console.
3. Ensure requests carry a valid authenticated session/token for that user.
4. Conditionally render archive controls based on the user's permissions in the UI.

// verify the permission before archiving
const perms = await fetchMyPermissions(rootAccountId)
if (!perms.includes('manage_institutional_tags_edit')) throw new Error('not authorized to archive tags')

try {
  await updateInstitutionalTagArchivedState(input)
} catch (e) {
  if (e.graphQLErrors?.some(g => g.message === 'not authorized')) {
    showAccessDeniedNotice()
  } else { throw e }
}

When it happens

Trigger: Calling the mutation as a user without the manage_institutional_tags_edit permission (students, teachers, or admin roles where the right was disabled), or with an unauthenticated/invalid session so no qualifying user is present.

Common situations: Custom account roles missing the granular permission; API tokens minted for a user who is not an institutional-tags manager; assuming site admin status grants the right on every account.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• insufficient permission
• insufficient permission
• Insufficient permissions
• not authorized
• not authorized

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/1a09c6cb7137f95a. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/update_institutional_tag_archived_state.rb:36

# with this program. If not, see <http://www.gnu.org/licenses/>.
#

# NOTE: Depends on InstitutionalTag and InstitutionalTagAssociation models

module Mutations
  class UpdateInstitutionalTagArchivedState < BaseMutation
    argument :archived, Boolean, required: true
    argument :id,
             ID,
             required: true,
             prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func("InstitutionalTag")

    field :institutional_tag, Types::InstitutionalTagType, null: true

    def resolve(input:)
      root_account = context[:domain_root_account]
      raise GraphQL::ExecutionError, "feature flag is disabled" unless root_account.feature_enabled?(:institutional_tags)
      raise GraphQL::ExecutionError, "not authorized" unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)

      tag = InstitutionalTag.where(root_account_id: root_account.id).find_by(id: input[:id])
      raise GraphQL::ExecutionError, "not found" unless tag

      input[:archived] ? tag.destroy : tag.undestroy

      { institutional_tag: tag }
    rescue ActiveRecord::RecordInvalid
      errors_for(tag)
    rescue ActiveRecord::RecordNotFound
      raise GraphQL::ExecutionError, "not found"
    end
  end
end

View on GitHub (pinned to 1c9f0bb801)