passbolt/passbolt_api · error · ForbiddenException

Only administrators are allowed to create/update password…

Error message

Only administrators are allowed to create/update password policies settings.

What it means

This ForbiddenException is thrown by PasswordPoliciesUpdateSetSettingsService::createOrUpdate when the ExtendedUserAccessControl object indicates the acting user is not an administrator. Password policy settings are EE-level configuration that only admins may create or update, so the service enforces role-based access before processing the payload.

Solutions

1. Log in / authenticate as a user with the admin role before calling the endpoint
2. Verify the UAC passed to createOrUpdate is built from an admin user's access control
3. Check the user's role in the database (roles table) and promote them to admin if appropriate
4. Ensure the route's authentication middleware correctly identifies the user so isAdmin() evaluates the right identity

Example fix

// before
$this->post('/password-policies.json', $payload); // as non-admin user
// after
$this->authenticateAs('admin');
$this->post('/password-policies.json', $payload);

if (!uac.isAdmin()) { throw new Error('Password policies settings can only be modified by administrators'); }

const isAdminUser = (uac: { isAdmin(): boolean }): boolean => uac.isAdmin();

When it happens

Trigger: POST to the password policies settings endpoint by a logged-in user whose UAC role is not admin (e.g. a user or admin-less role), or calling createOrUpdate directly in code/tests with a UAC built for a non-admin user.

Common situations: A non-admin user (or automation using a non-admin API key/user) attempts to change password policies; integration tests reuse a non-admin UAC fixture; role assignment changes stripped admin from the account.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Only admin can create or update organization settings.
• Only admin can create or update subscription information.
• Only administrators are allowed to create/update MFA…
• Only administrators are allowed to create/update MFA…
• Only administrators can create SSO settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/6b6a0402f2236e92. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/PasswordPoliciesUpdate/src/Service/PasswordPoliciesUpdateSetSettingsService.php:50

    /**
     * Event name. Fired after passwords policies settings has been saved.
     *
     * @var string
     */
    public const EVENT_SETTINGS_UPDATED = 'Service.PasswordPoliciesSetSettings.updated';

    /**
     * Create passwords policies settings if not present already in DB or updates the settings value if already exists.
     *
     * @param \App\Utility\ExtendedUserAccessControl $uac Extended user access control.
     * @param array $requestData Request data.
     * @return \Passbolt\PasswordPoliciesUpdate\Model\Dto\PasswordPoliciesUpdateSettingsDto
     */
    public function createOrUpdate(ExtendedUserAccessControl $uac, array $requestData): PasswordPoliciesUpdateSettingsDto // phpcs:ignore
    {
        if (!$uac->isAdmin()) {
            throw new ForbiddenException(
                __('Only administrators are allowed to create/update password policies settings.')
            );
        }

        $form = new PasswordPoliciesSettingsForm();
        if (!$form->execute($requestData)) {
            throw new FormValidationException(__('Could not validate the password policies settings.'), $form);
        }

        /** @var \Passbolt\PasswordPoliciesUpdate\Model\Dto\PasswordPoliciesUpdateSettingsDto $settingsDto */
        $settingsDto = PasswordPoliciesUpdateSettingsDto::createFromArray($form->getData());

        /** @var \Passbolt\PasswordPoliciesUpdate\Model\Table\PasswordPoliciesSettingsTable $passwordPoliciesSettingsTable */
        $passwordPoliciesSettingsTable = $this->fetchTable('Passbolt/PasswordPoliciesUpdate.PasswordPoliciesSettings'); // phpcs:ignore

        /** @var \Passbolt\PasswordPoliciesUpdate\Model\Entity\PasswordPoliciesSetting $passwordPoliciesSetting */
        $passwordPoliciesSetting = $passwordPoliciesSettingsTable->createOrUpdateSetting(
            $passwordPoliciesSettingsTable->getProperty(),

View on GitHub (pinned to 31c1bbc10f)