n8n-io/n8n · warning

User is missing a scope required to perform this action

Error message

User is missing a scope required to perform this action

What it means

Returned as a 403 JSON response by `createScopedMiddleware` when `userHasScopes(req.user, [scope], globalOnly, req.params)` resolves to false. The body is `{ status: 'error', message: RESPONSE_ERROR_MESSAGES.MISSING_SCOPE }` ('User is missing a scope required to perform this action'). The user is authenticated but lacks the specific RBAC scope required by the route.

Source

Thrown at packages/cli/src/controller.registry.ts:245

		return (_req, res, next) => {
			if (!this.license.isLicensed(feature)) {
				res.status(403).json({ status: 'error', message: 'Plan lacks license for this feature' });
				return;
			}
			next();
		};
	}

	private createScopedMiddleware(accessScope: AccessScope): RequestHandler {
		return async (req, res, next) => {
			if (!isAuthenticatedRequest(req)) throw new UnauthenticatedError();
			if (!req.user) throw new UnauthenticatedError();

			const { scope, globalOnly } = accessScope;

			try {
				if (!(await userHasScopes(req.user, [scope], globalOnly, req.params))) {
					res.status(403).json({
						status: 'error',
						message: RESPONSE_ERROR_MESSAGES.MISSING_SCOPE,
					});
					return;
				}
			} catch (error) {
				if (error instanceof NotFoundError) {
					res.status(404).json({ status: 'error', message: error.message });
					return;
				}
				throw error;
			}

			next();
		};
	}
}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Have an owner/admin assign the required role or scope to the user.
2. Re-authenticate so the updated scopes are loaded into the session.
3. If calling the Public API, use an API key whose role includes the needed scope.
4. Confirm `globalOnly` semantics — some scopes require a global admin role.

const required = ['user:list'];
if (!await userHasScopes(currentUser, required, false, {})) {
  throw new Error(`User missing scopes: ${required.join(', ')}`);
}

try { await api.get('/admin/users'); } catch (e) { if (e.response?.status === 403) { requestScopeUpgrade(); } else throw e; }

When it happens

Trigger: A non-admin user calls an endpoint that requires `user:list` or `project:edit`; a project member without owner role calls an owner-only endpoint; a global-only endpoint called by a project-scoped user.

Common situations: Role downgraded after permission change; new endpoint added with a scope the user's role does not include; cross-project access attempted by a member of a different project.

Related errors

• Plan lacks license for this feature
• error.message
• output.error.errors[0]
• 401
• 500

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/8b54e72ea9429dc6. Report an issue: GitHub.