n8n-io/n8n · error · NodeOperationError

Authorization failed - insufficient permissions for document

Error message

Authorization failed - insufficient permissions for document upload.

What it means

The populateVectorStore catch block reclassifies errors whose message contains '403'/'Forbidden' or whose statusCode === 403 as an authorization NodeOperationError tailored to writes. The key is valid but cannot perform write/insert operations.

Source

Thrown at packages/@n8n/nodes-langchain/nodes/vector_store/VectorStoreAzureAISearch/VectorStoreAzureAISearch.node.ts:523

			) {
				throw new NodeOperationError(
					context.getNode(),
					'Authentication failed during document upload - invalid API key or endpoint.',
					{
						itemIndex,
						description:
							'Please verify your API Key and Search Endpoint are correct in the credentials configuration.',
					},
				);
			}

			// Check for authorization errors
			if (
				error.message?.includes('403') ||
				error.message?.includes('Forbidden') ||
				(error as any).statusCode === 403
			) {
				throw new NodeOperationError(
					context.getNode(),
					'Authorization failed - insufficient permissions for document upload.',
					{
						itemIndex,
						description:
							'The API Key does not have sufficient permissions for write operations. Ensure the key has the required access level.',
					},
				);
			}

			// Check for RestError (common Azure SDK error)
			if ((error as any).name === 'RestError' || error.message?.includes('RestError')) {
				const statusCode = (error as any).statusCode || 'unknown';
				const errorCode = (error as any).code || 'unknown';
				const errorMessage = error instanceof Error ? error.message : String(error);
				throw new NodeOperationError(
					context.getNode(),
					`Azure AI Search API error (${statusCode}): ${errorMessage}`,

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Use an admin key (or a key with write permission) for document upload.
2. Grant Search Index Data Contributor via Azure RBAC if using role-based access.
3. Confirm the target index is not in read-only/consuming state.

// Require a write-capable key for populateVectorStore.
const cred = await getValidatedCredentials(context, itemIndex);
if (!cred.isAdminKey) throw new Error('Document upload requires an admin/write-capable Azure AI Search key.');

When it happens

Trigger: vectorStore.addDocuments fails with an error matching '403'/'Forbidden' or error.statusCode === 403 — a read-only query key used to insert documents.

Common situations: A query key (read-only) was supplied for the insert/load-documents operation; Azure RBAC roles do not include write access; the index is in read-only mode.

Related errors

• Authorization failed - insufficient permissions.
• Authentication failed during document upload - invalid API k
• Azure AI Search API error (${statusCode}): ${errorMessage}
• Parameter ${key} must be a string
• Azure AI Search endpoint is missing or invalid

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/3baf557223632ce8. Report an issue: GitHub.