vxcontrol/pentagi · error

You do not have permission to execute the api.

Error message

You do not have permission to execute the api.

What it means

The same interceptor (frontend/src/lib/axios.ts:126) recognizes backend JSON error codes AuthRequired, NotPermitted, PrivilegesRequired, AdminRequired and SuperRequired. When a failing response carries one of these codes it logs 'You do not have permission to execute the api.', clears the stored auth data (AUTH_STORAGE_KEY), and redirects to the login page with the current path preserved.

Source

Thrown at frontend/src/lib/axios.ts:126

                    if (currentPath !== routes.login()) {
                        window.location.href = routes.login(currentPath);
                    }

                    break;
                }

                case 403: {
                    const responseData = err.response?.data as undefined | { code?: string };

                    if (
                        responseData?.code === 'AuthRequired' ||
                        responseData?.code === 'NotPermitted' ||
                        responseData?.code === 'PrivilegesRequired' ||
                        responseData?.code === 'AdminRequired' ||
                        responseData?.code === 'SuperRequired'
                    ) {
                        Log.warn('You do not have permission to execute the api.');
                        localStorage.removeItem(AUTH_STORAGE_KEY);

                        const currentPath = window.location.pathname;

                        if (currentPath !== routes.login()) {
                            window.location.href = routes.login(currentPath);
                        }
                    } else {
                        Log.warn(err.response?.data);
                    }

                    break;
                }

                case 409: {
                    // Conflict is an expected outcome for operations with an
                    // overwrite workflow (move, copy, etc.).  The calling hook
                    // handles it and shows a prompt; there is nothing to log.

View on GitHub (pinned to ea665308ba)

Solutions

1. Log in with an account that has the required role (admin/super-admin) for the endpoint — the redirect flow returns you to the page after re-authentication.
2. Regenerate the API token with the necessary permissions/scopes if the call uses Bearer-token auth.
3. Confirm on the backend which error code the endpoint returns and adjust the UI to hide features the current role cannot use.
4. If you believe access should be granted, have an administrator update the user's role/privileges on the server.

Example fix

// before
export const SomeSetting = () => { ... }
// after (guard admin-only UI so the call is never made without the role)
if (!user.isAdmin) return <AccessDenied />;
return <SomeSetting />;

const canCall = (user: User, needed: 'admin' | 'super') =>
  needed === 'admin' ? user.isAdmin : user.isSuperAdmin;
if (!canCall(user, 'admin')) throw new Error('NotPermitted: admin role required');

function isPermissionError(e: unknown): e is AxiosError {
  if (!axios.isAxiosError(e)) return false;
  const code = (e.response?.data as any)?.code;
  return ['AuthRequired','NotPermitted','PrivilegesRequired','AdminRequired','SuperRequired'].includes(code);
}

try {
  await api.post('/admin/setting', payload);
} catch (err) {
  if (isPermissionError(err)) {
    Log.warn('Missing privileges for this operation');
    return; // or surface a permission-denied UI state
  }
  throw err;
}

When it happens

Trigger: Any API call whose error response body has responseData.code set to one of the five auth codes — typically a 403/401 payload from the backend signaling that the authenticated principal lacks the privileges (user vs admin vs super-admin) required by the endpoint.

Common situations: A regular user opening an admin-only settings page whose queries then fail; an API token created with insufficient scopes calling a privileged endpoint; role downgraded server-side while the stale client session persists; accessing a GraphQL mutation restricted to AdminRequired/SuperRequired roles.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• permission 'resources.view' required to use resource IDs
• Authentication required.
• Token.Unauthorized
• failed to create schema %q: %w
• failed to create extension %q in schema %q (a privileged use

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/feb620eab796ca61. Report an issue: GitHub.