[Bug] Updating Interface fails with HTTP 403 Forbidden

[Christophoclese]

Bug Description

For some reason, when attempting to modify the lag of an existing interface using Set-NBDCIMInterface I am getting an HTTP 403 Forbidden error from the API. If I attempt to replicate the same PATCH request using the Swagger UI and the same API key, it succeeds with a 200 OK.

Function/Cmdlet Affected

• Function: Set-NBDCIMInterface
• Module: DCIM

Steps to Reproduce

1. Connect to Netbox: Connect-NBAPI -Hostname '...' -Credential $cred
2. Run command: Set-NBDCIMInterface -Id 382 -LAG 37919 -Verbose
3. See error:

Expected Behavior

The interface is updated with the referenced LAG.

Actual Behavior

Set-NBDCIMInterface -Id 382 -LAG 37919 -Verbose
VERBOSE: Updating D CI MI nt er fa ce
VERBOSE: Retrieving DCIM Interface
VERBOSE: Building URI components
VERBOSE:  Adding ID to segments
VERBOSE: Building URI
VERBOSE: Checking connection status
VERBOSE:  URIPath: api/dcim/interfaces/382/
VERBOSE:  Completed building URIBuilder
VERBOSE: Getting Netbox Timeout
VERBOSE: Getting Netbox InvokeParams
VERBOSE: [1/3] GET https://dev.netbox.domain.tld/api/dcim/interfaces/382/
VERBOSE: Requested HTTP/1.1 GET with 0-byte payload
VERBOSE: Received HTTP/1.1 1426-byte response of content type application/json
VERBOSE: Content encoding: utf-8
VERBOSE: No 'results' property found, returning full response
VERBOSE: Building URI components
VERBOSE:  Adding lag parameter
VERBOSE: Building URI
VERBOSE: Checking connection status
VERBOSE:  URIPath: api/dcim/interfaces/382/
VERBOSE:  Completed building URIBuilder
VERBOSE: Performing the operation "Set" on target "Interface ID 382".
VERBOSE: Getting Netbox Timeout
VERBOSE: Getting Netbox InvokeParams
VERBOSE: BODY: {"lag":37919}
VERBOSE: [1/3] PATCH https://dev.netbox.domain.tld/api/dcim/interfaces/382/
VERBOSE: Requested HTTP/1.1 PATCH with 13-byte payload
VERBOSE: Received HTTP/1.1 63-byte response of content type application/json
VERBOSE: Extracting error body from HttpResponseMessage (PowerShell Core)
VERBOSE: Could not read response body: Exception calling "ReadAsStringAsync" with "0" argument(s): "Cannot access a disposed object.
Object name: 'System.Net.Http.HttpConnectionResponseContent'."
InvokeNetboxRequest: Netbox API Error: 403 Forbidden Endpoint: PATCH
https://dev.netbox.domain.tld/api/dcim/interfaces/382/ Message: Response status code does
not indicate success: 403 (Forbidden).  Troubleshooting: - Verify your API token has permission for
this operation - Check object-level permissions in Netbox - Ensure the token user has the required role

Environment

• PowerNetbox Version: 4.5.6.0
• Netbox Version: 4.4.10
• PowerShell Version: 7.5.3
• PowerShell Edition: Core
• OS: Ubuntu 24.04.3 LTS on WSL2

Additional Context

I copied the body from the verbose output and used it in the Swagger UI on the PATCH /api/dcim/interfaces/{id}/ endpoint and the request was successful:

curl -X 'PATCH' \
  'https://dev.netbox.domain.tld/api/dcim/interfaces/382/' \
  -H 'accept: application/json' \
  -H 'Authorization: <redacted>' \
  -H 'Content-Type: application/json' \
  -H 'X-CSRFTOKEN: <redacted>' \
  -d '{"lag":37919}'

Possible Solution (optional)

[Christophoclese]

I realized last night that when I made the Swagger UI API call that I did not have a branch set (not sure if you can even do that there, I'll look into it), however in PowerNetbox I used Enter-NBBranch before this error, so the API call I made doesn't accurately emulate the problematic request. I'll try and dig a bit deeper, sorry if I jumped the gun on reporting an issue.

[ctrl-alt-automate]

Thanks for the detailed report and especially for the full -Verbose output — that made this much easier to unpack. No worries at all about following up after the fact; the second comment is exactly the kind of context that helps.

Analysis

Two things jumped out when I read the verbose trace against the current dev source:

1. The installed module looks older than 4.5.6.0

Three specific lines in your output come from code paths that were removed/fixed well before 4.5.6.0:

Symptom in your log	Status in 4.5.6.0	Fixed in
VERBOSE: Updating D CI MI nt er fa ce (garbled noun)	Replaced with "Updating DCIM Interface"	PR #178 (v4.5.0.2)
VERBOSE: Retrieving DCIM Interface + a GET before the PATCH	Removed — Set-* no longer pre-fetches	PR #226 (v4.5.2.0)
VERBOSE: Could not read response body: ... Cannot access a disposed object	Replaced with $_.ErrorDetails.Message path for PS Core	PR #170 (v4.5.0.2)

All three of those indicate the module loaded in your session predates v4.5.0.2. Could you double-check with:

Get-Module PowerNetbox | Format-List Name, Version, Path
Get-Module PowerNetbox -ListAvailable | Format-List Name, Version, Path

If an older copy is winning on $env:PSModulePath, a clean re-import should sort it out:

Remove-Module PowerNetbox -Force -ErrorAction SilentlyContinue
Update-Module PowerNetbox -Force
Import-Module PowerNetbox -Force

2. The 403 itself is almost certainly branch-scoped, not module-scoped

Given your follow-up — you had called Enter-NBBranch before the failing Set-NBDCIMInterface, and the Swagger replay was against main — the X-NetBox-Branch header goes out on every branched request (including the PATCH). That means the branch routing is working; what fails is the authorisation inside the branched schema.

Common causes, in order of likelihood:

• The token user has read permissions that apply cluster-wide but a write permission (dcim.change_interface) that's constrained in a way that doesn't match the branch schema
• The branch is in a state that blocks writes (merged, syncing, archived)
• The branching plugin version on that 4.4.10 instance is < 0.7.2 and has known auth-handling quirks

Two quick diagnostics that will nail it down:

# 1. Does the GET-then-PATCH work in the main schema?
Exit-NBBranch
Set-NBDCIMInterface -Id 382 -LAG 37919 -Verbose

# 2. Inside the branch, can you make *any* write succeed?
#    (e.g. a tag edit on a test interface — something cheap)
Enter-NBBranch -Name '<your-branch>'
Set-NBDCIMInterface -Id <some-test-id> -Description "probe $(Get-Date -Format o)" -Verbose

If (1) works and (2) fails, it's the branch permission set. If both fail once you're on the real 4.5.6.0 build, please post the updated verbose trace and I'll dig deeper.

Fix

Regardless of the root cause here, the current 403 message gives no hint that a branch context is active, which made this issue harder to self-diagnose than it should have been. PR #384 fixes that:

When BuildDetailedErrorMessage runs with an active branch on the stack, 401 and 403 errors now include the branch name + schema_id and branch-specific troubleshooting tips (verify branch write permissions, check if the branch is merged/archived, try Exit-NBBranch to isolate). No change when no branch is active.

Example of what the next 403 inside a branch will look like:

Netbox API Error: 403 Forbidden
Endpoint: PATCH https://netbox.example.com/api/dcim/interfaces/382/
Message: Response status code does not indicate success: 403 (Forbidden).

Troubleshooting:
- Verify your API token has permission for this operation
- Check object-level permissions in Netbox
- Ensure the token user has the required role
- Active branch context: feature/new-datacenter (schema_id: nbs_abc123)
- Verify write permissions apply within the branch schema
- Confirm the branch is not merged, archived, or read-only
- Use Exit-NBBranch to test if the operation succeeds in main context

I'll leave this issue open until you've had a chance to confirm (a) which version you're actually running and (b) whether the branch-permission angle explains the 403.

[ctrl-alt-automate]

Update — PowerNetbox v4.5.7.0 is just out on PSGallery and includes two things relevant to this issue:

1. Better diagnostics for branch-context auth failures (PR #384)

When a 401 or 403 happens inside an Enter-NBBranch context, the error message now includes the active branch name + schema_id and branch-specific troubleshooting hints. The next time you hit the original problem, you'll see something like:

Netbox API Error: 403 Forbidden
Endpoint: PATCH https://dev.netbox.domain.tld/api/dcim/interfaces/382/
Message: Response status code does not indicate success: 403 (Forbidden).

Troubleshooting:
- Verify your API token has permission for this operation
- Check object-level permissions in Netbox
- Ensure the token user has the required role
- Active branch context: <your-branch-name> (schema_id: nbs_xxx)
- Verify write permissions apply within the branch schema
- Confirm the branch is not merged, archived, or read-only
- Use Exit-NBBranch to test if the operation succeeds in main context

That should make it much easier to confirm whether your 403 is a token issue or a branch-permission issue.

2. Your installed version was almost certainly older than 4.5.6.0

The verbose output you originally posted contains three fingerprints of code that was removed before 4.5.0.2 (Updating D CI MI nt er fa ce, an extra GET before the PATCH, the Cannot access a disposed object warning). Updating to 4.5.7.0 will pick up those three fixes too:

Update-Module PowerNetbox -Force
Remove-Module PowerNetbox -Force -ErrorAction SilentlyContinue
Import-Module PowerNetbox
Get-Module PowerNetbox | Select-Object Version, Path

If after the update you still hit a 403 inside a branch context, please paste the new verbose output here — with the branch hints in the error message, we should be able to pinpoint the cause quickly.

Release: https://github.com/ctrl-alt-automate/PowerNetbox/releases/tag/v4.5.7.0