mastra-ai/mastra · warning · HTTPException

You do not have permission to update this connection

Error message

You do not have permission to update this connection

What it means

A 403 thrown when the authenticated caller is neither the connection's author nor an admin, and the connection is not shared-scope. The server prevents non-owners from updating a personal-scope connection.

Solutions

1. Have the connection's author make the update, or ask them to set its scope to 'shared'.
2. Obtain admin permissions (admin bypass for the tool-providers resource) for the caller.
3. Create your own connection and reference its ID instead.

Example fix

// before (non-owner personal connection)
await api.put(`/api/tool-providers/github/connections/${id}`, { label: 'new-label' }); // 403
// after: author shares the connection first
await api.put(`/api/tool-providers/github/connections/${id}`, { scope: 'shared' }); // by author
// now any member can update

const conn = (await api.get(`/api/tool-providers/${providerId}/connections`)).connections.find(c => c.connectionId === id);
const canUpdate = conn && (conn.scope === 'shared' || conn.authorId === currentUserId || isAdmin);
if (!canUpdate) throw new Error('Not allowed to update this connection');

try {
  await api.put(`/api/tool-providers/${p}/connections/${id}`, { label });
} catch (e) {
  if (e.status === 403) throw new Error('Ask the connection owner or an admin to make this change.');
  throw e;
}

When it happens

Trigger: PUT/PATCH to update a connection (e.g. its label) where match.scope !== 'shared', match.authorId !== callerAuthorId, and the request context lacks admin bypass for TOOL_PROVIDERS_RESOURCE.

Common situations: Team member updating a colleague's personally-created connection; service account lacking admin claims performing maintenance on user-owned connections; caller authenticated as a different user than who created the connection.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• You do not have permission to disconnect this connection
• You do not have permission to view usage for this connection
• You need the admin role in this organization to manage…
• Access denied: cannot save messages for a different resource
• Access denied: durable run belongs to a different resource

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/b5621f12dfc42a35. Report an issue: GitHub.

Appendix: source

Thrown at packages/server/src/server/handlers/tool-providers.ts:700

      const storage = mastra.getStorage();
      const store = await storage?.getStore('toolProviderConnections');
      if (!store) {
        throw new HTTPException(500, {
          message: 'Tool provider connections storage is not configured',
        });
      }

      const rows = await store.listConnectionsByAuthor({ providerId: provider.info.id });
      const match = rows.find(r => r.connectionId === connectionId);
      if (!match) {
        throw new HTTPException(404, {
          message: `Connection ${connectionId} not found for provider ${providerId}`,
        });
      }

      const isShared = match.scope === 'shared';
      if (!isShared && match.authorId !== callerAuthorId && !isAdmin) {
        throw new HTTPException(403, {
          message: 'You do not have permission to update this connection',
        });
      }

      // Normalize: empty string and explicit null both clear the label.
      const nextLabel: string | null = typeof label === 'string' && label.trim().length > 0 ? label.trim() : null;

      await store.upsertConnection({
        authorId: match.authorId,
        providerId: provider.info.id,
        toolkit: match.toolkit,
        connectionId,
        label: nextLabel,
        scope: match.scope,
      });

      return { ok: true as const, label: nextLabel };
    } catch (error) {

View on GitHub (pinned to 75dd419e61)