API access stops working after /export/plaintext #5481

New Issue

OVERLORD · 2026-02-05T10:05:57+03:00

OVERLORD commented

2026-02-05 10:05:57 +03:00

Originally created by @different-thinking on GitHub (Nov 6, 2025).

Describe the Bug

Hello,

I just created a fresh API-Token and tried a couple of endpoints which are working fine.
When I use /api/pages/{id}/export/html its working
When I use /api/pages/{id}/export/plaintext I get a 403 with message: "The owner of the used API token does not have permission to make API calls"
After this I get this error on all API requests even the one worked before

Generating a new token doesn't solve the issue. I need to wait a certain time or so.

Steps to Reproduce

Create a new API Token
Call any endpoint → working
call /export/plaintext → 403

Expected Behaviour

All endpoints are working

Screenshots or Additional Context

I use Bruno for API testing access

Browser Details

No response

Exact BookStack Version

BookStack v25.07.3

Originally created by @different-thinking on GitHub (Nov 6, 2025). ### Describe the Bug Hello, I just created a fresh API-Token and tried a couple of endpoints which are working fine. When I use /api/pages/{id}/export/html its working When I use /api/pages/{id}/export/plaintext I get a 403 with message: "The owner of the used API token does not have permission to make API calls" After this I get this error on all API requests even the one worked before Generating a new token doesn't solve the issue. I need to wait a certain time or so. ### Steps to Reproduce 1. Create a new API Token 2. Call any endpoint → working 3. call /export/plaintext → 403 ### Expected Behaviour All endpoints are working ### Screenshots or Additional Context I use Bruno for API testing access ### Browser Details _No response_ ### Exact BookStack Version BookStack v25.07.3

OVERLORD added the 🐛 Bug label 2026-02-05 10:05:57 +03:00

OVERLORD closed this issue

2026-02-05 10:05:59 +03:00

OVERLORD commented

2026-02-05 10:06:02 +03:00

@different-thinking commented on GitHub (Nov 6, 2025):

I think I encountered the exact behaviour:

Before /plaintext I did a request which leads to 404 with the bookstacks error page shown. call the API after this leads to the 403. Deleting the cookies fix the issue.

Sorry for bothering.

@different-thinking commented on GitHub (Nov 6, 2025): I think I encountered the exact behaviour: Before /plaintext I did a request which leads to 404 with the bookstacks error page shown. call the API after this leads to the 403. Deleting the cookies fix the issue. Sorry for bothering.

OVERLORD commented

2026-02-05 10:06:03 +03:00

@ssddanbrown commented on GitHub (Nov 13, 2025):

Yeah, cookies on the request, if existing, will be used over the API credentials as a way to provide logged-in users an easy way to browse the API.

No worries, will therefore close this off.

@ssddanbrown commented on GitHub (Nov 13, 2025): Yeah, cookies on the request, if existing, will be used over the API credentials as a way to provide logged-in users an easy way to browse the API. No worries, will therefore close this off.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5481