API: Resrouce set users endpoint returns 403 when using root API Key #955

New Issue

MrUnknownDE · 2026-04-05T18:02:59+02:00

MrUnknownDE commented

2026-04-05 18:02:59 +02:00

Originally created by @yasalmasri on 9/7/2025

Bug Description

Trying to add user to a resource through Pangolin API with root API Key, but it returns HTTP status code 403 with error message: Key does not have access to this organization, I tried to replicate the same request with organization API Key and it works with no error.

Steps to Reproduce

Create Root API Key with all permissions.
Make this request:

curl -X POST 'https://pangolin.domain.com/v1/resource/17/users' \
  --header 'Content-Type: application/json' \
  --data '{
  "userIds": [
    "USER_ID"
  ]
}' \
  --header 'Authorization: Bearer ROOT_API_KEY'

Response received:

{
  "data": null,
  "success": false,
  "error": true,
  "message": "Key does not have access to this organization",
  "status": 403,
  "stack": null
}

Actual Behavior

API request returns http status code 403.

Expected Behavior

API request should return 201 and user should be added to resource.

Environment

Pangolin Version: 1.9.4
Deployment: Docker (fosrl/pangolin)
OS: Ubuntu 24.10

*Originally created by @yasalmasri on 9/7/2025* ## Bug Description Trying to add user to a resource through Pangolin API with root API Key, but it returns HTTP status code 403 with error message: `Key does not have access to this organization`, I tried to replicate the same request with organization API Key and it works with no error. ## Steps to Reproduce - Create Root API Key with all permissions. - Make this request: ```bash curl -X POST 'https://pangolin.domain.com/v1/resource/17/users' \ --header 'Content-Type: application/json' \ --data '{ "userIds": [ "USER_ID" ] }' \ --header 'Authorization: Bearer ROOT_API_KEY' ``` - Response received: ```json { "data": null, "success": false, "error": true, "message": "Key does not have access to this organization", "status": 403, "stack": null } ``` ## Actual Behavior API request returns http status code 403. ## Expected Behavior API request should return 201 and user should be added to resource. ## Environment Pangolin Version: 1.9.4 Deployment: Docker (fosrl/pangolin) OS: Ubuntu 24.10

MrUnknownDE closed this issue

2026-04-05 18:03:00 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#955