passbolt/passbolt_api · error · ForbiddenException

You are not allowed to access this location.

Error message

You are not allowed to access this location.

What it means

ForbiddenException thrown by AccountRecoveryOrganizationPoliciesSetController::assertIsAdmin() when the authenticated user is not an administrator. Only admins may change account recovery organization policies.

Solutions

1. Log in as a user with the admin role before calling the endpoint
2. Grant the admin role to the intended user (users table role_id)
3. In tests, use an admin-authenticated request fixture
4. Confirm authorization middleware is loading the correct user role

Example fix

// before
$this->authenticateAs('ada'); // regular user role
$this->put('/account-recovery/organization-policies.json', $data); // 403
// after
$this->authenticateAs('admin');
$this->put('/account-recovery/organization-policies.json', $data); // 200

const me = await selfClient.get();
if (me.role.name !== 'admin') throw new Error('admin role required to set organization policies');

function isAdminUser(user: {role: {name: string}}): boolean {
  return user.role.name === 'admin';
}

try {
  await organizationPoliciesService.set(policy);
} catch (ApiError e) {
  if (e.status === 403 && e.message.includes('not allowed to access this location')) {
    hidePolicySettingsUi(); // user lacks admin rights
  }
}

When it happens

Trigger: PUT /account-recovery/organization-policies.json performed by a logged-in non-admin user or an anonymous request that passes authentication middleware as guest.

Common situations: Non-admin account attempting policy changes via API directly; missing admin role assignment in the test fixture; token/role misconfiguration making the user appear non-admin.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• You are not authorized to access that location.
• Only admin can create or update subscription information.
• Only guests are allowed to create an account recovery…
• Only guests are allowed to proceed with account recovery.
• " " is not a valid search filter.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/e511b6518234197f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryOrganizationPolicies/AccountRecoveryOrganizationPoliciesSetController.php:72

     * @throw BadRequestException if no data are provided
     * @return void
     */
    protected function assertRequestData(): void
    {
        $data = $this->request->getData();
        if (!isset($data) || !is_array($data) || !count($data)) {
            throw new BadRequestException(__('The request data should not be empty.'));
        }
    }

    /**
     * @throw ForbiddenException if the user is not an administrator
     * @return void
     */
    protected function assertIsAdmin(): void
    {
        if (!$this->User->isAdmin()) {
            throw new ForbiddenException(__('You are not allowed to access this location.'));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)