passbolt/passbolt_api · error · Cake\Http\Exception\ForbiddenException

You are not authorized to share this resource.

Error message

You are not authorized to share this resource.

What it means

Thrown by ShareController::_assertRequestParameters when the authenticated user lacks OWNER permission on the target resource. Only resource owners may share it (or simulate sharing it); other permission levels (edit/read) get 403.

Solutions

1. Ask an existing owner of the resource to perform the share, or to grant your user OWNER permission.
2. Verify the permission level with GET /permissions/resource/<id>.json.
3. Log in as an administrator only if policy allows elevating ownership.

Example fix

// before
await api.put(`/share/resource/${id}`, changes); // user is EDITOR
// after
const perms = await api.get(`/permissions/resource/${id}.json`);
if (perms.find(p => p.user.id === me.id)?.type === 1 /* OWNER */) await api.put(`/share/resource/${id}`, changes);

const perms = (await api.get(`/permissions/resource/${resourceId}.json`)).body;
const mine = perms.find(p => p.user?.id === me.id);
if (!mine || mine.type !== 1 /* OWNER */) throw new Error('only owners can share this resource');

function isOwner(permission) { return permission?.type === 1; }

try { await share(id, perms); } catch (e) { if (e.status === 403 && /not authorized to share/.test(e.message)) { requestOwnerAction(id); } else throw e; }

When it happens

Trigger: PUT /share/resource/<uuid> or /share/simulate/<uuid> executed by a user whose highest permission on the resource is not OWNER — e.g. an editor attempting to add recipients.

Common situations: Automations running with a service account that only has edit rights; a user who was demoted from owner to editor trying to reshare; team workflows where ownership was transferred elsewhere.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Only administrators are allowed to create/update MFA…
• You are not allowed to access this location.
• Access restricted to administrators.
• Only admin can create or update organization settings.
• Only admin can create or update subscription information.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/ee08240162058c76. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Share/ShareController.php:145

    {
        if (!Validation::uuid($resourceId)) {
            throw new BadRequestException(__('The resource identifier should be a valid UUID.'));
        }
        // Retrieve the resource to simulate the share with.
        try {
            $resource = $this->Resources->get($resourceId);
        } catch (RecordNotFoundException $e) {
            throw new NotFoundException(__('The resource does not exist.'));
        }
        // The resource is not soft deleted.
        if ($resource->deleted) {
            throw new NotFoundException(__('The resource does not exist.'));
        }
        // The user can access the resource.
        $acoType = PermissionsTable::RESOURCE_ACO;
        $userId = $this->User->id();
        if (!$this->Resources->Permissions->hasAccess($acoType, $resourceId, $userId, Permission::OWNER)) {
            throw new ForbiddenException(__('You are not authorized to share this resource.'));
        }
        // V5 validations
        $resourceDto = MetadataResourceDto::fromArray($resource->toArray());
        if ($resourceDto->isV5() && $resource->get('metadata_key_type') === 'user_key') {
            throw new BadRequestException(__('Resource metadata key type is invalid.'));
        }
    }

    /**
     * Format the result.
     *
     * This entry point is used by the plugin app, and due to the V1 legacy the output body must be
     * formatted as following:
     *
     * [
     *   'changes' => [
     *     'added' => [
     *       ['User' => ['id' => uuid]],

View on GitHub (pinned to 31c1bbc10f)