instructure/canvas-lms · error · Lti::SubscriptionsValidator::ToolNotInContext

Tool does not have access to requested context

Error message

Tool does not have access to requested context

What it means

Raised by Lti::SubscriptionsValidator#check_tool_context! when the context (course/account) the subscription targets is not one where the tool proxy is active (active_in_context? is false). Canvas refuses to let a tool subscribe to live events from a context it is not installed in.

Solutions

1. Install or re-activate the tool proxy in the requested course/account context
2. Change the subscription's context to one where the tool is active
3. Verify context_link/context ids resolve to the intended course and not a migrated one
4. Check tool proxy deployment state (workflow_state active) in the target context

Example fix

// before
{ subscription: { ContextType: 'course', ContextId: '123' } } // tool not in course 123
// after
{ subscription: { ContextType: 'course', ContextId: '456' } } // tool active in course 456

ctx = resolve_context(context_type, context_id)
raise 'tool not active in context' unless tool_proxy.active_in_context?(ctx)

begin
  validator.validate_subscription_request!
rescue Lti::SubscriptionsValidator::ToolNotInContext
  deploy_tool_to_context(context_id) || subscribe_in_active_context
end

When it happens

Trigger: POSTing a subscription whose context_link/context (resolved via subscription_context, unwrapping course if it is an enrollment) is a course or account where the tool proxy is not installed or has been deactivated/deleted.

Common situations: Tool installed only at sub-account level but subscribing to root-account events; tool removed from a course after a subscription was attempted; admin moved course to another account where the tool is not active; using a course context_id belonging to a different account.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Missing required capability
• EventType # is invalid
• Access token expired
• Access token invalid - signature likely incorrect
• ActiveRecord::RecordNotFound

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/50dc873413422cf1. Report an issue: GitHub.

Appendix: source

Thrown at app/controllers/lti/subscriptions_validator.rb:61

      @tool_proxy = tool_proxy
    end

    def check_required_capabilities!
      capabilities_hash = ToolConsumerProfile.webhook_subscription_capabilities
      return if tool_proxy.enabled_capabilities.include?(ToolConsumerProfile.webhook_grant_all_capability)

      subscription[:EventTypes].each do |event_type|
        raise MissingCapability, "EventType #{event_type} is invalid" unless capabilities_hash.key?(event_type.to_sym)
        unless tool_proxy.enabled_capabilities.intersect?(capabilities_hash[event_type.to_sym])
          raise MissingCapability, "Missing required capability"
        end
      end
    end

    def check_tool_context!
      requested_context = subscription_context
      requested_context = requested_context.course if requested_context.respond_to?(:course)
      raise ToolNotInContext, "Tool does not have access to requested context" unless tool_proxy.active_in_context?(requested_context)
    end

    def validate_subscription_request!
      check_required_capabilities!
      check_tool_context!
    end

    def self.validate_subscription_context!(subscription)
      raise ContextNotFound unless retrieve_context(subscription).present?

      true
    end

    def self.retrieve_context(subscription)
      model = CONTEXT_WHITELIST[subscription[:ContextType]]
      raise InvalidContextType unless model

      case subscription[:ContextType]

View on GitHub (pinned to 1c9f0bb801)