Skip to content

Detective Alert Authority Required

URI: https://docs.ankatech.co/errors/detective-alert-authority-required
HTTP Status: 403 Forbidden

When you see this

You tried to change a platform alert condition that is security-detective, and you do not hold admin.platform.alerts.detective.manage. A security-detective condition fires when the platform is under attack or has lost a security control, for example when audit events are rejected or a sign-in posture is exposed. Switching it off, raising its threshold, stretching its dwell or its cooldown would let that attack run without anyone being told, so only the platform super administrator may change it.

admin.platform.alerts.write still reconfigures every other condition. Nothing was changed and no audit row was written.

Common Causes

  • A platform operator edited a condition whose securityDetective is true in GET /api/v3/admin/platform/alerts/conditions.
  • An automation tried to tune every condition in one pass, security-detective ones included.

Response Example

{
  "type": "https://docs.ankatech.co/errors/detective-alert-authority-required",
  "title": "Detective Alert Authority Required",
  "status": 403,
  "detail": "This alert condition is security-detective; changing it requires the 'admin.platform.alerts.detective.manage' scope",
  "instance": "/api/v3/admin/platform/alerts/conditions/audit.trail.stopped",
  "extensions": {
    "requestId": "3f9a1c62-8d4e-4b7a-9c15-6e2d0b8a4f71"
  }
}

How to Resolve

  1. Ask a platform super administrator to make the change, or to confirm that it is wanted.
  2. Leave the condition as it is if the change was part of tuning operational alerts: only the conditions with securityDetective: false are yours to tune with admin.platform.alerts.write.
  3. A security-detective condition's dwell (forSeconds) is at most 3600 seconds for every caller; a longer one is refused with 422.