odoo/odoo · error · AccessError

This page is only accessible to %s users.

Error message

This page is only accessible to %s users.

What it means

Access gate on the /doc SPA route (api_doc module): the doc client page is only for members of the 'api_doc.group_allow_doc' group. Users outside the group get AccessError naming the group. The route uses auth='user', so it fires for any authenticated but unauthorized user.

Source

Thrown at addons/api_doc/controllers/api_doc.py:41

from odoo.http import content_disposition, request
from odoo.modules.module_graph import ModuleGraph
from odoo.service.model import get_public_method
from odoo.tools import hmac, json_default, lazy_classproperty, py_to_js_locale

logger = logging.getLogger(__name__)


class DocController(http.Controller):
    """
    A single page application that provides an OpenAPI-like interface
    feeded by a reflection of the registry (fields and methods) in JSON
    documents.
    """

    @http.route(['/doc', '/doc/<model_name>', '/doc/index.html'], type='http', auth='user')
    def doc_client(self, mod=None, **kwargs):
        if not self.env.user.has_group('api_doc.group_allow_doc'):
            raise AccessError(self.env._(
                "This page is only accessible to %s users.",
                self.env.ref('api_doc.group_allow_doc').sudo().name))
        res = request.render('api_doc.docclient')
        res.headers['X-Frame-Options'] = 'deny'
        return res

    @http.route('/doc-bearer/index.json', type='json2', auth='bearer')
    def doc_bearer_index(self):
        return self.doc_index()

    @http.route('/doc/index.json', type='json2', auth='user')
    def doc_index(self):
        """
        Get a listing of all modules, models, methods and fields. But
        only their technical name and translated "human" name.

        It returns a json-serialized dictionnary with the following
        structure:

View on GitHub (pinned to 1e661df964)

Solutions

1. Add the user to the api_doc.group_allow_doc group (Settings > Users > Access Rights / technical groups)
2. Or remove/protect the /doc route at the reverse-proxy level if the doc module is installed but unused
3. Consider uninstalling api_doc on production databases where introspection docs are not needed

if not env.user.has_group('api_doc.group_allow_doc'):
    raise AccessError('Doc pages restricted')

def can_view_docs(env) -> bool:
    return env.user.has_group('api_doc.group_allow_doc')

try:
    env['api_doc.controller'].doc_client()
except AccessError:
    # show login/insufficient-rights page
    redirect('/')

When it happens

Trigger: Opening /doc, /doc/<model>, or /doc/index.html while the current env.user lacks group 'api_doc.group_allow_doc' (typically only a dedicated 'Documentation' technical group).

Common situations: Internal users without the doc group bookmarking /doc; sharing doc links in a team where the group was never assigned; testing on a DB where the group has no members.

Related errors

• You do not have permissions to remove the access token
• Peppol Error [code=%(error_code)s]: %(error_subject)s %(erro
• Signup is not allowed for uninvited users
• Could not select database '%s'
• Only administrators can upload a module

AI-assisted analysis of odoo/odoo@1e661df964 (2026-08-15). Data as JSON: /api/errors/1a9c981e12d41e27. Report an issue: GitHub.