What causes "You are not authorized to access that location." in passbolt/passbolt_api?

Log in as / use an administrator account

passbolt/passbolt_api · error · ForbiddenException

You are not authorized to access that location.

Error message

You are not authorized to access that location.

What it means

AdminOnlyRoleActionAccessControlService::controlUserRoleActionAccess throws ForbiddenException for any role that is not admin. This service is used for RBAC management actions that only administrators may perform, so a 403 is returned for non-admin callers.

Solutions

Log in as / use an administrator account
Grant the admin role to the user who needs to manage RBACs
Check that the correct authenticated session/token is being used (not a lesser-privileged one)
Do not call this endpoint from non-admin clients; use documented user-facing APIs instead

Example fix

null

Defensive patterns

Strategy: type-guard

Validate before calling

$isAdmin = $user->role->isAdmin(); if (!$isAdmin) { // skip or hide the RBAC admin UI }

Type guard

function isAdminRole(Role $role): bool { return $role->isAdmin(); }

Try / catch

try { $service->controlUserRoleActionAccess($role, $actionId); } catch (ForbiddenException $e) { // show 403 / redirect non-admins }

Prevention

Only expose RBAC admin endpoints to admin accounts in the client
Check the current user's role before rendering admin controls
Ensure test fixtures use an admin UAC when exercising this endpoint

When it happens

Trigger: A logged-in user with a non-admin role (user, etc.) attempts to update role/action RBAC settings via the RBACS update endpoint.

Common situations: Regular users trying to change their own permissions; API tokens belonging to non-admin accounts; tests or scripts hitting the endpoint with the wrong account.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/2adf18134267e158. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Rbacs/src/Service/ActionAccessControl/AdminOnlyRoleActionAccessControlService.php:33

 * @since         5.8.0
 */

namespace Passbolt\Rbacs\Service\ActionAccessControl;

use App\Model\Entity\Role;
use Cake\Http\Exception\ForbiddenException;

class AdminOnlyRoleActionAccessControlService implements RoleActionAccessControlServiceInterface
{
    /**
     * @inheritDoc
     */
    public function controlUserRoleActionAccess(Role $role, string $actionId): void
    {
        if ($role->isAdmin()) {
            return;
        }
        throw new ForbiddenException(__('You are not authorized to access that location.'));
    }
}

View on GitHub (pinned to 31c1bbc10f)