langgenius/dify · error · Forbidden

You don't have the permission to access the requested resour

Error message

You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.

What it means

Flask-RESTful Forbidden (HTTP 403, default message shown) raised by PATCH /console/api/datasets/{dataset_id}/documents/{document_id}/processing/{pause|resume} when current_user.is_dataset_editor is False (datasets_document.py:1244). Only admin, owner, dataset_operator, or editor roles may pause/resume processing.

Source

Thrown at api/controllers/console/datasets/datasets_document.py:1245

    @with_current_tenant_id
    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
    @with_session
    def patch(
        self,
        session: Session,
        current_tenant_id: str,
        current_user: Account,
        dataset_id: UUID,
        document_id: UUID,
        action: Literal["pause", "resume"],
    ):
        dataset_id_str = str(dataset_id)
        document_id_str = str(document_id)
        document = self.get_document(session, dataset_id_str, document_id_str, current_user, current_tenant_id)

        # The role of the current user in the ta table must be admin, owner, dataset_operator, or editor
        if not current_user.is_dataset_editor:
            raise Forbidden()

        match action:
            case "pause":
                if document.indexing_status != IndexingStatus.INDEXING:
                    raise InvalidActionError("Document not in indexing state.")

                document.paused_by = current_user.id
                document.paused_at = naive_utc_now()
                document.is_paused = True

            case "resume":
                if document.indexing_status not in {IndexingStatus.PAUSED, IndexingStatus.ERROR}:
                    raise InvalidActionError("Document not in paused or error state.")

                document.paused_by = None
                document.paused_at = None
                document.is_paused = False

View on GitHub (pinned to ef8544b173)

Solutions

1. Have an owner/admin grant the caller a dataset-editor-capable role (admin, owner, editor, or dataset_operator).
2. Use an account whose role satisfies is_dataset_editor for pause/resume actions.
3. Move the integration to the service API surface if it only has service-level credentials.

# Pre-flight: confirm the caller has an editor-capable role
me = console.get_current_user()
if me.get("role") not in {"owner", "admin", "editor", "dataset_operator"}:
    raise PermissionError("Only dataset editors may pause/resume processing.")

def is_dataset_editor(user: dict) -> bool:
    return user.get("is_dataset_editor") is True or user.get("role") in {"owner", "admin", "editor", "dataset_operator"}

try:
    console.process_document(dataset_id, document_id, action="pause")
except HTTPError as e:
    if e.response.status_code == 403:
        notify_user("You need an editor role to pause or resume this document.")
    else:
        raise

When it happens

Trigger: A viewer, app-reviewer, or member-with-no-role user calls processing pause or resume; a service API key lacking the dataset editor scope is used against the console route.

Common situations: New teammate added as viewer; RBAC roles downgraded; console route hit by an integration that uses a non-editor token.

Related errors

• archived_document_immutable
• You don't have the permission to access the requested resour
• access_denied
• server_5xx
• Knowledge creation failed during create

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/6bf84cc4ecf9aee4. Report an issue: GitHub.