Submit Feedback
Legacy Knowledge Base
Published Jun. 30, 2025

Guest can't update (call put method) in object headless API

Written By

Tamas Kovacs

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • When trying to update a specific object through Headless API calls with a guest user (using an angular app), the following error is displayed:
     
    {

        "status": "FORBIDDEN",

        "title": "User 20099 must have UPDATE permission for com.liferay.object.model.ObjectDefinition#64782 65097"

    }

Environment

  • One of the following actions are used:
     <action-key>ADD_DOCUMENT</action-key>
     <action-key>ADD_DOCUMENT_TYPE</action-key>
     <action-key>ADD_FOLDER</action-key>
     <action-key>ADD_REPOSITORY</action-key>
     <action-key>ADD_SHORTCUT</action-key>
     <action-key>ADD_STRUCTURE</action-key>
     <action-key>PERMISSIONS</action-key>
     <action-key>SUBSCRIBE</action-key>
     <action-key>UPDATE</action-key>

Resolution

  • These actions are disabled on purpose.
    This is not only for Objects, but is extended behavior through all the product. It is not possible to give write permissions to Guest via UI or API so we offer no workaround.
    We would really not recommend you to try to give those permissions to avoid risks.
    Please note that if you would have such API call options for guests, any bad actor could use it to edit / delete / etc. all related records, therefore Liferay only allows these type of actions for authenticated "users"(/apps).

Additional Information

 

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?