passbolt/passbolt_api · error · Cake\Http\Exception\ForbiddenException

You are not authorized to access that location.

Error message

You are not authorized to access that location.

What it means

Thrown by UsersDeleteController::_validateRequestData when the authenticated user's role is not ADMIN. Deleting users (and the dry-run variant) is restricted to administrators; everyone else receives a generic 403.

Solutions

1. Use an administrator account for user deletion requests.
2. Grant the required role via another admin if the operation is legitimate.
3. For self-service removal, use the appropriate self-delete/profile flow instead of the admin delete endpoint.

Example fix

// before
await api.delete(`/users/${id}.json`); // as role=user -> 403
// after
const adminApi = createClient({ token: adminToken });
await adminApi.delete(`/users/${id}.json`);

const me = await api.get('/users/me.json');
if (me.body.role.name !== 'admin') throw new Error('deleting users requires an admin account');

function isAdmin(session) { return session?.role?.name === 'admin'; }

try { await api.delete(`/users/${id}.json`); } catch (e) { if (e.status === 403 && /not authorized to access that location/.test(e.message)) { elevateToAdmin(); } else throw e; }

When it happens

Trigger: DELETE /users/<id>.json or its dry-run executed by a 'user' or 'guest' role account.

Common situations: Automation using a non-admin service account; an admin whose role was downgraded but whose client still calls admin endpoints; hitting the wrong environment where the account is not an admin.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Only administrators can add new users.
• You are not authorized to access that location.
• Access restricted to administrators.
• An administrator user cannot be deleted via SCIM.
• Could not delete the user

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8591d8e6ca56e424. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Users/UsersDeleteController.php:157

        $this->success(__('The user has been deleted successfully.'));
    }

    /**
     * Assert request sanity and return the sanitized data
     *
     * @param string $id user uuid
     * @throws \Cake\Http\Exception\ForbiddenException if current user is not an admin
     * @throws \Cake\Http\Exception\BadRequestException if the user uuid id invalid
     * @throws \Cake\Http\Exception\BadRequestException if the user tries to delete themselves
     * @throws \Cake\Http\Exception\NotFoundException if the user does not exist or is already deleted
     * @return \App\Model\Entity\User $user entity
     */
    protected function _validateRequestData(string $id)
    {
        // Admin can delete all users
        if ($this->User->role() !== Role::ADMIN) {
            throw new ForbiddenException(__('You are not authorized to access that location.'));
        }
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The user identifier should be a valid UUID.'));
        }
        // An admin cannot delete themselves
        if ($id === $this->User->id()) {
            throw new BadRequestException(__('You are not allowed to delete yourself.'));
        }

        /** @var \App\Model\Entity\User $user */
        $user = $this->Users->findDelete($id, $this->User->role())->first();
        if (empty($user)) {
            throw new NotFoundException(__('The user does not exist or has been already deleted.'));
        }

        return $user;
    }

View on GitHub (pinned to 31c1bbc10f)