mastra-ai/mastra · warning · HTTPException

You do not have permission to update this connection

Error message

You do not have permission to update this connection

What it means

A 403 thrown when the authenticated caller is neither the connection's author nor an admin, and the connection is not shared-scope. The server prevents non-owners from updating a personal-scope connection.

Source

Thrown at packages/server/src/server/handlers/tool-providers.ts:700

      const storage = mastra.getStorage();
      const store = await storage?.getStore('toolProviderConnections');
      if (!store) {
        throw new HTTPException(500, {
          message: 'Tool provider connections storage is not configured',
        });
      }

      const rows = await store.listConnectionsByAuthor({ providerId: provider.info.id });
      const match = rows.find(r => r.connectionId === connectionId);
      if (!match) {
        throw new HTTPException(404, {
          message: `Connection ${connectionId} not found for provider ${providerId}`,
        });
      }

      const isShared = match.scope === 'shared';
      if (!isShared && match.authorId !== callerAuthorId && !isAdmin) {
        throw new HTTPException(403, {
          message: 'You do not have permission to update this connection',
        });
      }

      // Normalize: empty string and explicit null both clear the label.
      const nextLabel: string | null = typeof label === 'string' && label.trim().length > 0 ? label.trim() : null;

      await store.upsertConnection({
        authorId: match.authorId,
        providerId: provider.info.id,
        toolkit: match.toolkit,
        connectionId,
        label: nextLabel,
        scope: match.scope,
      });

      return { ok: true as const, label: nextLabel };
    } catch (error) {

View on GitHub (pinned to 75dd419e61)

Solutions

1. Have the connection's author make the update, or ask them to set its scope to 'shared'.
2. Obtain admin permissions (admin bypass for the tool-providers resource) for the caller.
3. Create your own connection and reference its ID instead.

Example fix

// before (non-owner personal connection)
await api.put(`/api/tool-providers/github/connections/${id}`, { label: 'new-label' }); // 403
// after: author shares the connection first
await api.put(`/api/tool-providers/github/connections/${id}`, { scope: 'shared' }); // by author
// now any member can update

const conn = (await api.get(`/api/tool-providers/${providerId}/connections`)).connections.find(c => c.connectionId === id);
const canUpdate = conn && (conn.scope === 'shared' || conn.authorId === currentUserId || isAdmin);
if (!canUpdate) throw new Error('Not allowed to update this connection');

try {
  await api.put(`/api/tool-providers/${p}/connections/${id}`, { label });
} catch (e) {
  if (e.status === 403) throw new Error('Ask the connection owner or an admin to make this change.');
  throw e;
}

When it happens

Trigger: PUT/PATCH to update a connection (e.g. its label) where match.scope !== 'shared', match.authorId !== callerAuthorId, and the request context lacks admin bypass for TOOL_PROVIDERS_RESOURCE.

Common situations: Team member updating a colleague's personally-created connection; service account lacking admin claims performing maintenance on user-owned connections; caller authenticated as a different user than who created the connection.

Related errors

• You need the admin role in this organization to manage datab
• You do not have permission to disconnect this connection
• You do not have permission to view usage for this connection
• Attaching a database requires the admin role in your organiz
• Access denied: durable run belongs to a different resource

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/b5621f12dfc42a35. Report an issue: GitHub.