Back-end user role required to run Workflow API calls, even with proper permissioning

Problem Statement

Even if a user is permissioned with a role sufficient to view and edit content, the API response will report a lack of read permissions if the user does not also have the back-end user role.

{"message":"User 'user-3244a6be-d28b-4d80-a3fc-9f66a1d832ae' does not have READ permissions on Contentlet [name: Image Resizing and Processing, type: Documentation, lang: 1, identifier: 47ffbc9c-f224-47a2-ba6c-0fedb202dbe9, inode: 1aad4997-2970-4668-861d-3dc95383205e]"}

I'm not sure if this problem extends beyond just the Workflow API, but it's the one I happen to be using.

Steps to Reproduce

https://github.com/user-attachments/assets/44e8a983-603c-450a-b618-e1050fe99c34

1. Create role with permissions to view and edit content
2. Create non-admin user with role
3. Try to fire an EDIT system action with the workflow API
4. API call fails
5. Add Back End user role to user
6. API call succeeds

Acceptance Criteria

• Shouldn't this work even if back-end user isn't checked?
  • My reasoning is that a machine user is never going to want to log in, but now I'm second-guessing myself and wondering if any user who edits anything needs to be a back-end user.
  • But if that's true, then why would the error report insufficient READ permissions, rather than WRITE?

dotCMS Version

dotcms-core 26.06.22-01 (June 22, 2026 2:29 PM)

Severity

Medium - Some functionality impacted

Links

NA

Start by reproducing the failure with the Workflow API EDIT system action using the roles and user setup in the issue. Trace the permission checks involved in that call, especially the Back End user role and the reported READ permission error. Done means a properly permissioned user can make the call without that role, with the existing reproduction succeeding.