[bug]: User Cannot add Relation Through API With Access Token #10202

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

When using an access token towards Plane, creating work item relations returns 403 for workspace Members who are project Admin, only workspace Owners can.

Environment

• Plane Commercial v3.1.2, self-hosted
• Public API (/api/v1) with personal API keys (X-API-Key)

Summary

Creating a work item relation through the API returns 403 "You don't have permission to create this workitem_relation" for every key owned by a workspace Member, even when that user is Admin of the project. The same request with a key owned by a workspace Owner returns 201. The same Member account can add the relation in the web UI without a problem.

The permissions matrix lists relations as a project-level permission that project Admins and Contributors have. So the API-key path seems to check the workspace role where it should check the project role.

Findings

• The payload is fine. With the Owner key the same body gets 201, and invalid bodies get the normal 400 validation errors (rows 4–6).
• Members are refused before validation. With a Member key even an empty body gets 403 (row 4), so the request is rejected before the body is read.
• API key scopes are not the difference. All keys have scopes: [] (row 1). Only the workspace role differs.
• The project role makes no difference for Members. Project Admin and project Contributor both get 403.
• Only the API-key path is affected. The same Member account can create the relation in the web UI (row 10).
• Members can still write through the API. Their keys create and update work items fine (row 2), and reading relations works (row 3).

Expected

A workspace Member who is project Admin, or Contributor, can create work item relations through the API, as the permissions matrix says and as the web UI allows.

Actual

Only workspace Owners can create relations through the API. Workspace Members get 403 workitem_relation whatever their project role is.

Notes

• The error text workitem_relation doesn't appear in the open-source code. In the open-source code, the v1 relation endpoint uses the same permission check as creating a work item. The error seems to come from the Commercial permission engine (<resource_type>:<action>). The v2 permission grants docs say resource types the engine doesn't handle make every request return 403.
• The v4.0.0 changelog doesn't mention relations, API keys or 403s, so it isn't clear whether an upgrade fixes this.
• Workaround: give the API-key account the workspace Owner role. That gives it far more access than creating relations should need.

Steps to reproduce

POST /api/v1/workspaces/<workspace>/projects/<project_id>/work-items/<work_item_id>/relations/
Content-Type: application/json
X-API-Key: <key>

{"relation_type": "relates_to", "issues": ["<other_work_item_id>"]}

The project-Admin result in rows 4 and 7 is the same in two different projects.

Environment

Production

Browser

Google Chrome

Edition

Commercial

Version

v3.1.2