instructure/canvas-lms · error · GraphQL::ExecutionError

not authorized

Error message

not authorized

What it means

Raised by updateInstitutionalTagCategory when the current user lacks the :manage_institutional_tags_edit permission on the domain root account (root_account.grants_right?(current_user, session, :manage_institutional_tags_edit) is false). The mutation requires an explicitly granted institutional-tag management right; ordinary account admins without it are rejected.

Solutions

1. Grant the right: use a role with :manage_institutional_tags_edit (root account admin) or add the permission to the user's role via RoleOverride/custom admin role permissions.
2. Verify with a Rails console check: root_account.grants_right?(user, session, :manage_institutional_tags_edit).
3. Re-authenticate as an appropriately privileged user; ensure the token/session is valid so current_user is populated.

Example fix

// Rails console
# before: user lacks right
account.account_users.create!(user: user, role: account.roles.where(name: 'AccountAdmin').take)
# after: user now granted via AccountAdmin role which includes manage_institutional_tags_edit

// Rails console pre-check
raise 'no right' unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)

function hasManageRight(viewer) { return viewer?.permissions?.includes('manage_institutional_tags_edit') ?? false }

When it happens

Trigger: Any call to updateInstitutionalTagCategory where the authenticated user's role does not grant manage_institutional_tags_edit on the root account — e.g. a plain Teacher/Enrollment user token, an admin role missing the custom right, or an unauthenticated/expired session so current_user is nil.

Common situations: Using a personal access token from a user who isn't a root-account admin with the institutional-tags right, running queries as a masqueraded or API user with reduced roles, or a custom admin role created without this permission checked.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• insufficient permission
• insufficient permission
• insufficient permission
• insufficient permission
• Insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/71913dcea6bb327d. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/update_institutional_tag_category.rb:37

#

# NOTE: Depends on InstitutionalTagCategory model (app/models/institutional_tag_category.rb)

module Mutations
  class UpdateInstitutionalTagCategory < BaseMutation
    argument :description, String, required: false
    argument :id,
             ID,
             required: true,
             prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func("InstitutionalTagCategory")
    argument :name, String, required: false

    field :institutional_tag_category, Types::InstitutionalTagCategoryType, null: true

    def resolve(input:)
      root_account = context[:domain_root_account]
      raise GraphQL::ExecutionError, "feature flag is disabled" unless root_account.feature_enabled?(:institutional_tags)
      raise GraphQL::ExecutionError, "not authorized" unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)

      category = root_account.institutional_tag_categories.where(workflow_state: "active").find_by(id: input[:id])
      raise GraphQL::ExecutionError, "not found" unless category

      attrs = {}
      attrs[:name] = input[:name] if input.key?(:name)
      attrs[:description] = input[:description] if input.key?(:description)

      if category.update(attrs)
        { institutional_tag_category: category }
      else
        errors_for(category)
      end
    rescue ActiveRecord::RecordInvalid
      errors_for(category)
    rescue ActiveRecord::RecordNotFound
      raise GraphQL::ExecutionError, "not found"
    end

View on GitHub (pinned to 1c9f0bb801)