Issue Description
Trying to run the migration script and I’m hitting a 403 error on listing the settings. As I understand it, 403 indicates that authentication succeeded, but the user doesn’t have the correct privileges to perform the requested action. I’ve enabled nearly all possible permissions on this admin user in an attempt to circumvent the error to no avail.
Expected Behavior
Full export of settings and principals
Actual Behavior
“403 Forbidden for GET /api/settings/list”
Reproduction Steps
(.venv) $ python migrate_v016.py dump --url https://mail.example.com --username admin --password adminPass --settings settings.json --principals principals.json
Stalwart Version
v0.15.x
Installation Method
Docker
Database Backend
SQLite
Blob Storage
Filesystem
Search Engine
Internal
Directory Backend
Internal
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on
I have enough to answer now. The key point: setting individual permissions is not the correct approach — Stalwart uses an Admin role assignment (the roles field with UserRoles: Admin), which grants all the settings-*, principal-*, etc. permissions needed by the migration script. Let me check exact field name for basic auth and if the admin fallback (bootstrap) applies.
I did assign the “Admin” and “Tenant-Admin” roles as well with no success.
The 403 (as opposed to a 401) means you’re authenticated but the account lacks the SettingsList permission, which GET /api/settings/list requires. The Tenant-Administrator role deliberately doesn’t include SettingsList, so assigning that role won’t grant it, and a tenant-scoped account has its permissions intersected down regardless of what you toggle.
Run the dump as the true superadmin: the fallback administrator configured via authentication.fallback-admin (usually admin), which carries all permissions. If you’d rather use a created account, give it a full admin role that explicitly includes SettingsList rather than Tenant-Administrator. The v0.16 upgrade notes call this out: the admin account must have permission to read all settings and principals.