passbolt/passbolt_api · error · ForbiddenException

Only administrators are allowed to create/update user…

Error message

Only administrators are allowed to create/update user passphrase policies settings.

What it means

UserPassphrasePoliciesSetSettingsService::createOrUpdate requires the acting user to be an administrator via ExtendedUserAccessControl::isAdmin(). Any non-admin calling the set settings endpoint is rejected with this ForbiddenException before any validation or persistence occurs.

Solutions

1. Authenticate as a user with the administrator role before calling the endpoint.
2. Check the UAC/role assignment of the account being used and re-grant admin if legitimately required.
3. Use the server-side CLI (passbolt commands) for policy changes if API admin access is not available.

if (currentUser?.role?.name !== 'admin') throw new Error('Admin role required to set passphrase policies');

const isAdminUser = (u): u is AdminUser => u?.role?.name === 'admin';

catch (e) { if (e.status === 403) { notifyAdminRoleRequired(); } }

When it happens

Trigger: POST to the user passphrase policies settings endpoint authenticated as a non-admin user (or with a UAC lacking the admin role).

Common situations: A logged-in standard user or an API integration using a non-admin key tries to change the policy; an admin's role was revoked between login and the request; misconfigured automation credentials.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• An administrator user cannot be deleted via SCIM.
• An administrator user cannot be suspended via SCIM.
• Only administrators are allowed to create/update MFA…
• Only administrators can add new users.
• Only administrators can create SSO settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/e04fa879ffed0bb7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/UserPassphrasePolicies/src/Service/UserPassphrasePoliciesSetSettingsService.php:51

    /**
     * Event name. Fired after user passphrase policies settings has been saved.
     *
     * @var string
     */
    public const EVENT_SETTINGS_UPDATED = 'Service.UserPassphrasePoliciesSetSettings.updated';

    /**
     * Create user passphrase policy settings if not already present in DB or update the settings value if already exists.
     *
     * @param \App\Utility\ExtendedUserAccessControl $uac Extended user access control.
     * @param array $requestData Request data.
     * @return \Passbolt\UserPassphrasePolicies\Model\Dto\UserPassphrasePoliciesSettingsDto
     * @throws \Exception
     */
    public function createOrUpdate(ExtendedUserAccessControl $uac, array $requestData): UserPassphrasePoliciesSettingsDto // phpcs:ignore
    {
        if (!$uac->isAdmin()) {
            throw new ForbiddenException(
                __('Only administrators are allowed to create/update user passphrase policies settings.')
            );
        }

        $form = new UserPassphrasePoliciesSettingsForm();
        if (!$form->execute($requestData)) {
            throw new FormValidationException(
                __('Could not validate the user passphrase policies settings.'),
                $form
            );
        }

        /** @var \Passbolt\UserPassphrasePolicies\Model\Dto\UserPassphrasePoliciesSettingsDto $settingsDto */
        $settingsDto = UserPassphrasePoliciesSettingsDto::createFromArray($form->getData());

        /** @var \Passbolt\UserPassphrasePolicies\Model\Table\UserPassphrasePoliciesSettingsTable $userPassphrasePoliciesSettingsTable */
        $userPassphrasePoliciesSettingsTable = $this->fetchTable('Passbolt/UserPassphrasePolicies.UserPassphrasePoliciesSettings'); // phpcs:ignore

View on GitHub (pinned to 31c1bbc10f)