What causes "You are not allowed to access this location." in passbolt/passbolt_api?

Authenticate the request with an administrator account (role == 'admin') before calling the endpoint.

passbolt/passbolt_api · error · Cake\Http\Exception\ForbiddenException

You are not allowed to access this location.

Error message

You are not allowed to access this location.

What it means

A ForbiddenException thrown by NotificationOrgSettingsPostController::_validateRequestData when the authenticated user's role is not Role::ADMIN. The email notification organization settings can only be modified by administrators, so any non-admin POST to /email-notification-settings/org-settings is rejected with this message.

Solutions

Authenticate the request with an administrator account (role == 'admin') before calling the endpoint.
Check the user's role via the Users table or User role() and confirm it is Role::ADMIN.
If the user should be an admin, update their role in the users table and re-issue/re-login their session.
Verify the client is sending the correct CSRF/session/auth token so the right user is identified.

Example fix

// before (regular user token)
curl -X POST -H 'X-Http-Token: <user-token>' /email-notification-settings/org-settings

// after (admin token)
curl -X POST -H 'X-Http-Token: <admin-token>' /email-notification-settings/org-settings

Defensive patterns

Strategy: validation

Validate before calling

$user = User::find()->where(['id' => $userId])->first();
if (!$user || $user->role->name !== Role::ADMIN) {
    throw new ForbiddenException(__('You are not allowed to access this location.'));
}

Type guard

function isAdmin(?User $user): bool { return $user !== null && $user->get('role')->get('name') === Role::ADMIN; }

Try / catch

try {
    $response = $client->postEmailNotificationOrgSettings($data);
} catch (ForbiddenException $e) {
    // non-admin user; surface permission error to the caller
}

Prevention

Only invoke this endpoint from flows guaranteed to run as an admin.
Check the user's role client-side before making the request and hide/disable the action otherwise.
Never cache admin-only actions behind shared or service-account tokens with non-admin roles.
Log the acting user id on authorization failures to ease debugging.

When it happens

Trigger: POST to the email notification settings org settings endpoint (NotificationOrgSettingsPostController::post) while the request is authenticated as a user whose role() !== Role::ADMIN (e.g. 'user' or 'guest' role).

Common situations: Developers testing the endpoint with a regular user account or an API token bound to a non-admin user; users whose role was downgraded; requests where role resolution falls back to a non-admin (expired/limited account) even though the developer expected admin rights.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/61fc79e763a183af. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/EmailNotificationSettings/src/Controller/NotificationOrgSettings/NotificationOrgSettingsPostController.php:68

        $updatedNotificationSettings = EmailNotificationSettings::get();

        $flatten = Hash::flatten($updatedNotificationSettings);

        $msg = __('The notification settings for the organization were updated.');
        $this->success($msg, $this->_formatForOutput($flatten));
    }

    /**
     * Validate the request body
     *
     * @return array if the request body is valid
     * @throws \Cake\Http\Exception\ForbiddenException If the user making request is not admin
     * @throws \Cake\Http\Exception\BadRequestException If the request is not a Ajax/Json type
     */
    private function _validateRequestData(): array
    {
        if ($this->User->role() !== Role::ADMIN) {
            throw new ForbiddenException(__('You are not allowed to access this location.'));
        }
        if (!$this->request->is('json')) {
            throw new BadRequestException(__('This is not a valid Ajax/Json request.'));
        }

        $data = $this->request->getData();

        foreach ($data as $key => $value) {
            $data[$key] = QueryStringComponent::normalizeBoolean($value);
        }

        $form = new EmailNotificationSettingsForm();

        if (!$form->validate($data)) {
            $errors = $form->getErrors();

            throw new CustomValidationException(__('The supplied email notification settings are not valid'), $errors);
        }

View on GitHub (pinned to 31c1bbc10f)