API Access Request

[AartiNex]

Attempted Debugging

• I have read the debugging page

Searched GitHub Issues

• I have searched GitHub for the issue.

Describe the Scenario

I create a user with Admin role and gave all the permission to it including access api request. I was able to create api token from the user account but while making postman call giving error.

{
"error": {
"message": "The owner of the used API token does not have permission to make API calls",
"code": 403
}
}

Help me resolve it please

Exact BookStack Version

v25.02.4

Log Content

Details

[2025-05-19 11:59:33] local.ERROR: The owner of the used API token does not have permission to make API calls {"exception":"[object] (BookStack\\Exceptions\\ApiAuthException(code: 403): The owner of the used API token does not have permission to make API calls at C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\app\\Http\\Middleware\\ApiAuthenticate.php:36)
[stacktrace]
#0 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\app\\Http\\Middleware\\ApiAuthenticate.php(19): BookStack\\Http\\Middleware\\ApiAuthenticate->ensureAuthorizedBySessionOrToken()
#1 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): BookStack\\Http\\Middleware\\ApiAuthenticate->handle(Object(BookStack\\Http\\Request), Object(Closure))
#2 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Routing\\Middleware\\ThrottleRequests.php(161): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#3 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Routing\\Middleware\\ThrottleRequests.php(92): Illuminate\\Routing\\Middleware\\ThrottleRequests->handleRequest(Object(BookStack\\Http\\Request), Object(Closure), Array)
#4 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): Illuminate\\Routing\\Middleware\\ThrottleRequests->handle(Object(BookStack\\Http\\Request), Object(Closure))
#5 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Session\\Middleware\\StartSession.php(121): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#6 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Session\\Middleware\\StartSession.php(64): Illuminate\\Session\\Middleware\\StartSession->handleStatefulRequest(Object(BookStack\\Http\\Request), Object(Illuminate\\Session\\Store), Object(Closure))
#7 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\app\\Http\\Middleware\\StartSessionIfCookieExists.php(17): Illuminate\\Session\\Middleware\\StartSession->handle(Object(BookStack\\Http\\Request), Object(Closure))
#8 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): BookStack\\Http\\Middleware\\StartSessionIfCookieExists->handle(Object(BookStack\\Http\\Request), Object(Closure))
#9 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Cookie\\Middleware\\EncryptCookies.php(75): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#10 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle(Object(BookStack\\Http\\Request), Object(Closure))
#11 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(127): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#12 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Routing\\Router.php(807): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#13 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Routing\\Router.php(786): Illuminate\\Routing\\Router->runRouteWithinStack(Object(Illuminate\\Routing\\Route), Object(BookStack\\Http\\Request))
#14 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Routing\\Router.php(750): Illuminate\\Routing\\Router->runRoute(Object(BookStack\\Http\\Request), Object(Illuminate\\Routing\\Route))
#15 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Routing\\Router.php(739): Illuminate\\Routing\\Router->dispatchToRoute(Object(BookStack\\Http\\Request))
#16 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Http\\Kernel.php(201): Illuminate\\Routing\\Router->dispatch(Object(BookStack\\Http\\Request))
#17 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(170): Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}(Object(BookStack\\Http\\Request))
#18 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\app\\Http\\Middleware\\PreventResponseCaching.php(28): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#19 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): BookStack\\Http\\Middleware\\PreventResponseCaching->handle(Object(BookStack\\Http\\Request), Object(Closure))
#20 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Http\\Middleware\\TrustProxies.php(58): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#21 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\app\\Http\\Middleware\\TrustProxies.php(41): Illuminate\\Http\\Middleware\\TrustProxies->handle(Object(BookStack\\Http\\Request), Object(Closure))
#22 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): BookStack\\Http\\Middleware\\TrustProxies->handle(Object(BookStack\\Http\\Request), Object(Closure))
#23 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#24 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Http\\Middleware\\TrimStrings.php(51): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle(Object(BookStack\\Http\\Request), Object(Closure))
#25 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): Illuminate\\Foundation\\Http\\Middleware\\TrimStrings->handle(Object(BookStack\\Http\\Request), Object(Closure))
#26 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Http\\Middleware\\ValidatePostSize.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#27 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): Illuminate\\Http\\Middleware\\ValidatePostSize->handle(Object(BookStack\\Http\\Request), Object(Closure))
#28 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance.php(110): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#29 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(209): Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance->handle(Object(BookStack\\Http\\Request), Object(Closure))
#30 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Pipeline\\Pipeline.php(127): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(BookStack\\Http\\Request))
#31 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Http\\Kernel.php(176): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#32 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Http\\Kernel.php(145): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter(Object(BookStack\\Http\\Request))
#33 C:\\Users\\AartiRamola\\Documents\\Local projects\\BookStack\\public\\index.php(23): Illuminate\\Foundation\\Http\\Kernel->handle(Object(BookStack\\Http\\Request))
#34 {main}
"} 

Hosting Environment

PHP 8.1 and xampp in local

[ssddanbrown]

Hi @AartiNex,

Please ensure the user for which the API details have been created for, has a role assigned which still has the "Access System API" permission.
Also, ensure you are not using a session/cookies on the API requests from postman, as BookStack may be using the user session instead of the API credentials. This is especially likely if you're using PostMan's built in browser/cookie sync (which I think works in combination with a browser plugin).