Even tough through action permissions a role has no access to a certain collection, it can still be accessed through the API by using Appends.
l/api/companies?appends=not_accessable_entity_id wil happily append the entity.
nocobase/nocobase:2.1.0-beta.44-full on docker with postgres:17
Create role, limit access to sub-entities. Make an API call on parent entity with appends.
Screenshots for API call, and Installation/Component permissions for this user.
1 Like
may
June 8, 2026, 10:39am
2
Hi, could you help us with a couple of questions to investigate further:
Does the user account you’re testing with have multiple roles assigned?
When making the API request, did you include the x-role header? If so, what value was set?
This will help our team identify the root cause. Thank you!
Hi May,
I am using role union, however the user logging on to the api only has one role. (And is strictly limited).
Upon login on the api he gets a token and this is the only thing that is used in subsequent calls. I don’t use any additional headers.
Thanks in advance!
If it is a related table, the permissions for the relationship fields are in the parent table. Please check if the parent table has the necessary permissions for the relationship fields.
