User not synced (user_not_synced)
A denied decision with the code user_not_synced means the user key in the permission check doesn't match any user in the environment, so the user has no role assignments. This page is for developers who find this code in a decision log and need to sync the user or fix the user key in the check.
What the user_not_synced reason means
The policy decision point (PDP) writes this code in the role-based access control (RBAC) part of the decision log's debug details (debug.rbac). The debug details appear when Debug Mode is on.
| Field | Value |
|---|---|
code | user_not_synced |
reason | user '<user-key>' is not synced and therefore has no known role assignments |
support_link | A link to /errors/user_not_synced on docs.permit.io |
The PDP runs this check after it confirms that the resource type, the action, and the tenant exist. The PDP compares user keys exactly, so John@permit.io and john@permit.io are different users. The decision log's request.user.synced field is false for this user.
Causes of user_not_synced
| Cause | How to confirm | Fix |
|---|---|---|
| Your app authenticates the user, but never syncs the user to Permit. | The user key from the reason is missing from the Directory screen. | Sync the user. |
| The check sends a different identifier than the key the user was synced with, for example an email instead of the user ID from your identity provider. | The Directory screen has the user under another key. | Send the synced user key in permit.check(). |
| The user key has a different case than the synced key. | The keys differ only in case. | Send the user key with the exact case. |
| The check runs against a different environment than the one where you synced the user. | The user appears in the Directory screen of another environment. | Use the API key of the environment that has the user. See Get your API key. |
Fix user_not_synced
Sync the user during sign-up or sign-in, right after your identity provider authenticates the user. Include the user's role assignments in the sync, or the next check returns no_user_roles. For when and how to sync, see Sync users.
Sync the user with an SDK
Call permit.api.users.sync() or the equivalent in your SDK:
- Sync a user with the Node.js SDK
- Create or update a user with the Python SDK
- Sync a user with any SDK
Sync the user with the API
Call the Create user endpoint with the user key, or Replace user to create or update the user. For a complete request, see Create a user with the API.
Add the user in the Permit dashboard
To test a single user, add the user in the Directory screen. See Add a user in the Permit dashboard.
Confirm the fix
- Run the same
permit.check()call again with the same user, action, resource, and tenant. To run the check from a terminal, usepermit pdp check. - Open the Audit Log and select the new decision.
The debug.rbac.code is no longer user_not_synced, and request.user.synced is true.