API: Resrouce set users endpoint returns 403 when using root API Key #649

New Issue

2025-11-13T12:06:44-06:00

GiteaMirror commented

2025-11-13 12:06:44 -06:00

Originally created by @yasalmasri on GitHub (Sep 7, 2025).

Bug Description

Trying to add user to a resource through Pangolin API with root API Key, but it returns HTTP status code 403 with error message: Key does not have access to this organization, I tried to replicate the same request with organization API Key and it works with no error.

Steps to Reproduce

Create Root API Key with all permissions.
Make this request:

curl -X POST 'https://pangolin.domain.com/v1/resource/17/users' \
  --header 'Content-Type: application/json' \
  --data '{
  "userIds": [
    "USER_ID"
  ]
}' \
  --header 'Authorization: Bearer ROOT_API_KEY'

Response received:

{
  "data": null,
  "success": false,
  "error": true,
  "message": "Key does not have access to this organization",
  "status": 403,
  "stack": null
}

Actual Behavior

API request returns http status code 403.

Expected Behavior

API request should return 201 and user should be added to resource.

Environment

Pangolin Version: 1.9.4
Deployment: Docker (fosrl/pangolin)
OS: Ubuntu 24.10

Originally created by @yasalmasri on GitHub (Sep 7, 2025). ## Bug Description Trying to add user to a resource through Pangolin API with root API Key, but it returns HTTP status code 403 with error message: `Key does not have access to this organization`, I tried to replicate the same request with organization API Key and it works with no error. ## Steps to Reproduce - Create Root API Key with all permissions. - Make this request: ```bash curl -X POST 'https://pangolin.domain.com/v1/resource/17/users' \ --header 'Content-Type: application/json' \ --data '{ "userIds": [ "USER_ID" ] }' \ --header 'Authorization: Bearer ROOT_API_KEY' ``` - Response received: ```json { "data": null, "success": false, "error": true, "message": "Key does not have access to this organization", "status": 403, "stack": null } ``` ## Actual Behavior API request returns http status code 403. ## Expected Behavior API request should return 201 and user should be added to resource. ## Environment Pangolin Version: 1.9.4 Deployment: Docker (fosrl/pangolin) OS: Ubuntu 24.10

GiteaMirror closed this issue

2025-11-13 12:06:44 -06:00

GiteaMirror commented

2025-11-13 12:06:45 -06:00

@oschwartz10612 commented on GitHub (Sep 7, 2025):

Thanks for pointing this out! This will be fixed in the next release by
64722617c1

@oschwartz10612 commented on GitHub (Sep 7, 2025): Thanks for pointing this out! This will be fixed in the next release by 64722617c1481f0694047ce250e5ab9945c10b2d