Guides

You are not permitted to access this resource. Function ... is not whitelisted

Mukunda ·1 Nov 2026 ·2 min read

Applies to: Frappe v16.34.0, ERPNext v16.35.0. Self-hosted bench in developer mode. Checked 2026-11. Not checked on v15.

Symptom#

You call a Python method with frappe.call, a button or a REST request. Desk shows a "Method Not Allowed" dialog. The REST response has this exception:

text
frappe.exceptions.PermissionError: <details><summary>You are not permitted to access this resource. Login to access</summary>Function <strong>guide_demo.api.get_open_todos</strong> is not whitelisted.</details>

Method Not Allowed dialog in Desk

We got this error on a test app with this function:

python
import frappe


def get_open_todos():
    return frappe.get_all("ToDo", filters={"status": "Open"}, fields=["name", "description"])

Cause#

Frappe runs a Python function from a request only if it has the @frappe.whitelist() decorator. A Guest (a visitor who is not logged in) can call it only with allow_guest=True. Frappe does this check in is_whitelisted() in frappe/__init__.py.

The message says "Login to access" for both causes. It does not tell you which cause you have.

Fix#

  1. Open the Python file from the error. For guide_demo.api.get_open_todos, this is apps/guide_demo/guide_demo/api.py.

  2. Add @frappe.whitelist() above the function.

    python
    import frappe


@frappe.whitelist()
def get_open_todos():
    return frappe.get_all("ToDo", filters={"status": "Open"}, fields=["name", "description"])

  3. If visitors who are not logged in call the function, add allow_guest=True.

    python
    @frappe.whitelist(allow_guest=True)
def get_store_status():
    return "open"

    Anyone on the internet can call a guest function. frappe.get_all does not check permissions. Do not return private data from a guest function.

  4. Reload the code. With bench start in developer mode, our server reloaded when we saved the file. On a production bench, run this command:

    bash
    bench restart

    We did not test bench restart on a production bench for this guide.

  5. For a method in a DocType controller (called with frm.call), add the same decorator to that method. We got the same error for a controller method: Function frappe.desk.doctype.todo.todo.on_update is not whitelisted.

Check that it worked#

Log in to Desk. Open the browser console and run this:

js
frappe.call({ method: "guide_demo.api.get_open_todos" }).then((r) => console.log(r.message));

You get the records back. Our call returned this:

text
[{"name": "sk72jn1rn8", "description": "Check the whitelist fix"}]

The whitelisted method returns data

For a guest function, open https://<site-name>/api/method/<dotted.path.to.function> in a private window. Our guest call returned {"message":"open"}.

If it still fails#

  • Check the dotted path for typos. A wrong name gives a different error:

    text
    Failed to get method for command guide_demo.api.get_open_todo with module 'guide_demo.api' has no attribute 'get_open_todo'

  • After you install a new app, you can get ModuleNotFoundError: No module named 'guide_demo'. The running server started before the app existed. Stop bench start and start it again.

  • Look in ~/frappe-bench/logs/ for the newest error. Post it on discuss.frappe.io with your versions (bench version).

Sources#

Need help? Hire a Frappe developer