[GH-ISSUE #1423] API: Resrouce set users endpoint returns 403 when using root API Key #1902

New Issue

GiteaMirror · 2026-04-16T08:45:43-05:00

GiteaMirror commented

2026-04-16 08:45:43 -05:00

Originally created by @yasalmasri on GitHub (Sep 7, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1423

Bug Description

Trying to add user to a resource through Pangolin API with root API Key, but it returns HTTP status code 403 with error message: Key does not have access to this organization, I tried to replicate the same request with organization API Key and it works with no error.

Steps to Reproduce

Create Root API Key with all permissions.
Make this request:

curl -X POST 'https://pangolin.domain.com/v1/resource/17/users' \
  --header 'Content-Type: application/json' \
  --data '{
  "userIds": [
    "USER_ID"
  ]
}' \
  --header 'Authorization: Bearer ROOT_API_KEY'

Response received:

{
  "data": null,
  "success": false,
  "error": true,
  "message": "Key does not have access to this organization",
  "status": 403,
  "stack": null
}

Actual Behavior

API request returns http status code 403.

Expected Behavior

API request should return 201 and user should be added to resource.

Environment

Pangolin Version: 1.9.4
Deployment: Docker (fosrl/pangolin)
OS: Ubuntu 24.10

Originally created by @yasalmasri on GitHub (Sep 7, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1423 ## Bug Description Trying to add user to a resource through Pangolin API with root API Key, but it returns HTTP status code 403 with error message: `Key does not have access to this organization`, I tried to replicate the same request with organization API Key and it works with no error. ## Steps to Reproduce - Create Root API Key with all permissions. - Make this request: ```bash curl -X POST 'https://pangolin.domain.com/v1/resource/17/users' \ --header 'Content-Type: application/json' \ --data '{ "userIds": [ "USER_ID" ] }' \ --header 'Authorization: Bearer ROOT_API_KEY' ``` - Response received: ```json { "data": null, "success": false, "error": true, "message": "Key does not have access to this organization", "status": 403, "stack": null } ``` ## Actual Behavior API request returns http status code 403. ## Expected Behavior API request should return 201 and user should be added to resource. ## Environment Pangolin Version: 1.9.4 Deployment: Docker (fosrl/pangolin) OS: Ubuntu 24.10

GiteaMirror closed this issue

2026-04-16 08:45:43 -05:00

GiteaMirror commented

2026-04-16 08:45:45 -05:00

@oschwartz10612 commented on GitHub (Sep 7, 2025):

Thanks for pointing this out! This will be fixed in the next release by
64722617c1

@oschwartz10612 commented on GitHub (Sep 7, 2025): Thanks for pointing this out! This will be fixed in the next release by 64722617c1481f0694047ce250e5ab9945c10b2d

GiteaMirror referenced this issue

2026-04-16 09:35:20 -05:00

[PR #1902] [CLOSED] chore: format all files with prettier #2756

GiteaMirror referenced this issue

2026-04-20 09:02:46 -05:00

[PR #1902] [CLOSED] chore: format all files with prettier #4699

GiteaMirror referenced this issue

2026-04-23 02:41:57 -05:00

[PR #1902] [CLOSED] chore: format all files with prettier #5643

GiteaMirror referenced this issue

2026-04-25 16:18:01 -05:00

[PR #1902] [CLOSED] chore: format all files with prettier #7558