nextcloud/server · warning · Sabre\DAV\Exception\Forbidden

Permission denied to delete this collection

Error message

Permission denied to delete this collection

What it means

RootCollection::delete() refuses DELETE on the comments root collection with Forbidden (HTTP 403). Bulk deletion of the whole comment tree is not exposed over DAV; only individual comment nodes may be deleted.

Source

Thrown at apps/dav/lib/Comments/RootCollection.php:144

	 *
	 * @param string $name
	 * @return bool
	 */
	#[\Override]
	public function childExists($name) {
		$this->initCollections();
		assert(!is_null($this->entityTypeCollections));
		return isset($this->entityTypeCollections[$name]);
	}

	/**
	 * Deleted the current node
	 *
	 * @throws Forbidden
	 */
	#[\Override]
	public function delete() {
		throw new Forbidden('Permission denied to delete this collection');
	}

	/**
	 * Returns the name of the node.
	 *
	 * This is used to generate the url.
	 *
	 * @return string
	 */
	#[\Override]
	public function getName() {
		return $this->name;
	}

	/**
	 * Renames the node
	 *
	 * @param string $name The new name

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Delete comments individually: DELETE on the comment node under /dav/comments/<type>/<objectId>/<commentId>.
2. Use occ commands or the server-side CommentsManager for bulk operations.
3. Adjust cleanup scripts to never issue DELETE on collection nodes.

Example fix

// before: HTTP 403 Permission denied to delete this collection
$client->request('DELETE', '/remote.php/dav/comments');

// after: delete single comments
foreach ($commentIds as $id) {
    $client->request('DELETE', '/remote.php/dav/comments/files/123/' . $id);
}

When it happens

Trigger: DELETE /remote.php/dav/comments targeting the root collection; cleanup scripts or recursive WebDAV deleters that remove parent collections after emptying children.

Common situations: Data-cleanup scripts trying to wipe all comments; WebDAV clients that recurse delete; admins attempting GDPR-style purges over the DAV API.

Related errors

• Only authors are allowed to edit their comment.
• Cannot create comments by id
• Permission denied to create collections
• Permission denied to rename this collection
• Permission denied to delete the trashbin

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/29e32b4cb85ed326. Report an issue: GitHub.