Home / Help centre / Troubleshooting
Troubleshooting
Why does my API call return a permission error?
Every Cyberlop route checks one named permission, and a Bearer token carries only what its owner holds. A permission error means the owner's role lacks that permission, or the item sits outside the owner's group scope. Find the permission in the API Reference, then ask an admin.
Why this happens
Each route in Cyberlop enforces the permission listed beside it. A Bearer API token is not a master key, because it acts as the person who owns it, with that person's role and group scope. Refusal follows when the role lacks the permission.
How to fix it
- Open API Reference in the sidebar and type the path you called into the filter box.
- Read the permission chip at the right of the row. It follows the pattern
area:action, for exampletarget:createorscan:run. - Work out whose token you used, since a token made for a teammate runs as that teammate and not as you.
- Ask an admin to open that user's role and check for the permission. If a built-in role is too narrow, a custom role can add it. Read how to create a custom role.
- Check the scope as well. A token carries its owner's group scope, so a profile or target outside those groups can fail even when the permission is right.
- Repeat the call after the change.
Login and health are public. A few other routes ask only that you be signed in. Those cannot fail for this reason.
Still not working?
- Confirm the call goes to the right route and method. A
GETand aPOSTon one path need different permissions. - Check that the token has not been revoked. See why a token stopped working.
- Look at how to find an endpoint's permission.
Applying least privilege is the reason for this check, so grant only what the job needs. If you are sure the role is right, send us the route and the time of the call through the contact page. The API tokens and permissions tutorial has more.
Related questions
- How do I find the endpoint I need and the permission it requires?
- How do I authenticate requests to the Cyberlop API?
- My API token suddenly stopped working. Why?
- How do I create a custom role with specific permissions?
- Why do I get a permission error when I try to start a scan?
Cyberlop API tokens and permissions: how to issue and limit them
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Error still showing?
Send us the exact message and the page you were on. We will reply with the fix.