Permission Errors

Permission errors in PrimeCal occur at two levels: subscription-plan entitlements (which features your plan includes) and resource-level access (whether you own or have been granted access to a specific calendar or event). This page covers both.

---

"This feature requires a higher plan" / FEATURE_NOT_ENTITLED

Why it happens: PrimeCal gates features by subscription plan using the FeatureAccessGuard. When ENABLE_SUBSCRIPTIONS=true in the backend, attempting to use a feature your plan does not include returns:

{
  "code": "FEATURE_NOT_ENTITLED",
  "requiredFeature": "automation",
  "message": "Feature 'automation' requires a higher subscription plan"
}

The frontend shows a "Locked Feature" prompt instead of the feature panel when this condition is detected.

Affected features and their slugs:

What you tried to use	Feature slug
Automation rules and webhooks	automation
Google / Microsoft calendar sync	calendar_sync
Reservation / booking system	reservations
Task workspace	task_management
Personal logs / diary	personal_logs
AI agent / MCP integration	agent
Invite team members	seat_management
Bookable resources	resource_management
Public booking tokens	public_booking
Organisations	organisations
Personal API keys	api_access
People groups for sharing	user_groups

Fix (user): Upgrade your plan in Settings → Subscription. The feature becomes available immediately after the plan is updated — no logout required.

Fix (administrator): Go to the admin subscription portal → Feature Matrix → check the feature for the relevant plan.

---

"You have reached your limit" / PLAN_LIMIT_REACHED

Why it happens: Plans enforce numeric caps on certain resources. When you hit a cap, the create endpoint returns:

{
  "code": "PLAN_LIMIT_REACHED",
  "limitKey": "max_calendars",
  "limit": 5,
  "current": 5
}

Current enforced limits (Free plan defaults):

What you tried to create	Limit key	Free plan default
Calendars	max_calendars	5
Active automation rules	max_automation_rules	3
External sync accounts	max_calendar_sync_providers	1
Personal API keys	max_api_keys	2

Fix: Either delete an existing resource to free a slot, or upgrade to a paid plan with higher or unlimited caps.

---

"You do not have permission to edit this event"

Why it happens: Events belong to the user who created them, or to the calendar owner. If you are viewing a shared calendar in read-only mode, you cannot edit its events in PrimeCal.

Fix:

• Ask the calendar owner to give you edit access to the calendar.
• If the event came from an external sync (Google or Microsoft), edit it in the source calendar and allow the sync to bring the change back to PrimeCal.

---

"Admin access required" when visiting admin pages

Why it happens: The /admin area and GET /api/admin/* endpoints are protected by a guard that checks for the admin role. Regular users receive a 403 Forbidden response.

Fix: Your account must be granted the admin role by an existing system administrator. This is not a self-service action.

---

Feature is visible in the UI but returns a 403 when used

Why it happens: The frontend checks feature flags to decide whether to show a feature, but the backend independently enforces entitlements. A mismatch can occur if:

• The feature flag service cache (5-minute TTL) has not refreshed yet after a plan change.
• ENABLE_SUBSCRIPTIONS is set differently between environments.

Fix:

1. Wait 5 minutes for the frontend feature flag cache to expire and try again.
2. Hard-refresh the page (Ctrl+Shift+R) to force a fresh feature flag fetch.
3. Check the browser console for the exact 403 response body — it includes the code field identifying which guard rejected the request.

---

Still stuck?

• Check Settings → Subscription to see your current plan and included features.
• Administrators can review the plan_features and user_entitlements tables in the database for the exact entitlement state of a user.
• See Authentication Errors if you are receiving 401 (not 403) responses.