jellyfin/jellyfin · warning · AuthenticationException

Only admin users can retrieve the activity log.

Error message

Only admin users can retrieve the activity log.

What it means

ActivityLogWebSocketListener.Start throws AuthenticationException('Only admin users can retrieve the activity log.') when the websocket connection is neither an API key nor an administrator user. The activity log is admin-scoped, so subscribing to its websocket feed requires elevated privileges. The check reads AuthorizationInfo.IsApiKey and the user's IsAdministrator permission.

Source

Thrown at Jellyfin.Api/WebSocketListeners/ActivityLogWebSocketListener.cs:78

        {
            _activityManager.EntryCreated -= OnEntryCreated;
            _disposed = true;
        }

        await base.DisposeAsyncCore().ConfigureAwait(false);
    }

    /// <summary>
    /// Starts sending messages over an activity log web socket.
    /// </summary>
    /// <param name="message">The message.</param>
    protected override void Start(WebSocketMessageInfo message)
    {
        if (!message.Connection.AuthorizationInfo.IsApiKey
            && (message.Connection.AuthorizationInfo.User is null
                || !message.Connection.AuthorizationInfo.User.HasPermission(PermissionKind.IsAdministrator)))
        {
            throw new AuthenticationException("Only admin users can retrieve the activity log.");
        }

        base.Start(message);
    }

    private void OnEntryCreated(object? sender, GenericEventArgs<ActivityLogEntry> e)
    {
        SendData(true);
    }
}

View on GitHub (pinned to ae8723026d)

Solutions

1. Authenticate as an Administrator user, or use an API key, before subscribing to the ActivityLog websocket feed.
2. Have non-admin clients avoid the activity-log subscription message entirely.
3. Verify the session's role before attempting to subscribe.

Example fix

// before
socket.Send("ActivityLog", {}); // non-admin session
// after
if (session.IsAdmin) socket.Send("ActivityLog", {});

if (!session.IsAdministrator && !session.IsApiKey) { /* don't subscribe to ActivityLog */ }

bool CanReadActivityLog(AuthorizationInfo a) => a.IsApiKey || (a.User?.HasPermission(PermissionKind.IsAdministrator) ?? false);

try { socket.Subscribe("ActivityLog"); }
catch (AuthenticationException) { /* need admin/api key */ }

When it happens

Trigger: A non-admin authenticated client (or a non-API-key connection) sends the ActivityLog websocket message to subscribe to the activity-log feed, triggering Start's permission check.

Common situations: Regular user sessions opening the admin dashboard's activity feed; third-party clients subscribing without checking role; tokens downgraded from admin to user without the client noticing.

Related errors

• Token is required
• User must be authenticated to subscribe to session Informati
• Invalid token.
• User account has been disabled.
• Forbidden

AI-assisted analysis of jellyfin/jellyfin@ae8723026d (2026-08-13). Data as JSON: /api/errors/156754b17677092a. Report an issue: GitHub.