payloadcms/payload · error · APIError

Collection ${args.collection.config.slug} has disabled bulk

Error message

Collection ${args.collection.config.slug} has disabled bulk edit

What it means

Thrown at packages/payload/src/collections/operations/update.ts:77 with HTTP 403 at the top of `updateOperation` (the bulk/many-documents update path) when the collection config has `disableBulkEdit: true` AND `overrideAccess` is falsy. It prevents non-privileged callers from performing bulk edits on collections where the operator has explicitly disabled them. Note: `overrideAccess: true` bypasses this guard entirely.

Source

Thrown at packages/payload/src/collections/operations/update.ts:77

   * @example '-createdAt' // Sort DESC by createdAt
   * @example ['group', '-createdAt'] // sort by 2 fields, ASC group and DESC createdAt
   */
  sort?: Sort
  trash?: boolean
  unpublishAllLocales?: boolean
  where: Where
} & Pick<FindOptions<TSlug, SelectType>, 'select'>

export const updateOperation = async <
  TSlug extends CollectionSlug,
  TSelect extends SelectFromCollectionSlug<TSlug>,
>(
  incomingArgs: Arguments<TSlug>,
): Promise<BulkOperationResult<TSlug, TSelect>> => {
  let args = incomingArgs

  if (args.collection.config.disableBulkEdit && !args.overrideAccess) {
    throw new APIError(`Collection ${args.collection.config.slug} has disabled bulk edit`, 403)
  }

  try {
    const shouldCommit = !args.disableTransaction && (await initTransaction(args.req))

    // /////////////////////////////////////
    // beforeOperation - Collection
    // /////////////////////////////////////

    args = await buildBeforeOperation({
      args,
      collection: args.collection.config,
      operation: 'update',
      overrideAccess: args.overrideAccess!,
    })

    const {
      autosave = false,

View on GitHub (pinned to 00c58b35c0)

Solutions

  1. If bulk edit must stay disabled, update documents one at a time via the single-id form (`payload.update({ collection, id, data })`).
  2. If bulk edit should be allowed, remove `disableBulkEdit` (or set `false`) on the collection config.
  3. Only pass `overrideAccess: true` from trusted server-side code; never expose it to client input.

Example fix

// before — collection has disableBulkEdit: true, caller uses overrideAccess: false
await payload.update({ collection: 'orders', where: { status: { equals: 'pending' } }, data })

// after — update one document at a time
for (const id of ids) {
  await payload.update({ collection: 'orders', id, data })
}
// or, in trusted server code, override access:
await payload.update({ collection: 'orders', where: { status: { equals: 'pending' } }, data, overrideAccess: true })
Defensive patterns

Strategy: validation

Validate before calling

function assertBulkEditAllowed(payload: Payload, slug: CollectionSlug, overrideAccess: boolean): void {
  const collection = payload.collections[slug]
  if (collection?.config.disableBulkEdit && !overrideAccess) {
    throw new Error(`Collection '${slug}' has disabled bulk edit.`)
  }
}

assertBulkEditAllowed(payload, 'orders', false)
// if it throws, switch to single-doc updates or pass overrideAccess: true in trusted code

Type guard

const bulkEditAllowed = (
  payload: Payload,
  slug: CollectionSlug,
  overrideAccess: boolean,
): boolean => {
  const c = payload.collections[slug]
  return Boolean(c) && (c.config.disableBulkEdit !== true || overrideAccess === true)
}

Try / catch

try {
  await payload.update({ collection: slug, where, data })
} catch (err) {
  if (err instanceof APIError && err.status === 403 && /disabled bulk edit/.test(err.message)) {
    // fall back to per-document updates, or escalate overrideAccess in trusted server code
  } else throw err
}

Prevention

When it happens

Trigger: Calling `payload.update({ collection: 'orders', where: {...}, data })` (many-doc form) while the user is authenticated (`overrideAccess` false/default in REST) and the collection sets `disableBulkEdit: true`; an admin UI bulk-edit attempt on such a collection.

Common situations: Setting `disableBulkEdit: true` on transactional collections (orders, invoices) but leaving bulk-edit UI/actions enabled; a refactor that switched a call from single-doc update to the many-doc form.

Related errors

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/2b04a9d056b93cf2. Report an issue: GitHub.