Repository: auth0/auth0-deploy-cli

Issue:
Problem loading tenant data from Auth0 ManagementApiError: Please upgrade your subscription to enable Tenant ACL Management.
### Checklist

- [x] I have looked into the [README](https://github.com/auth0/auth0-deploy-cli#readme) and have not found a suitable solution or answer.
- [x] I have looked into the [documentation](https://github.com/auth0/auth0-deploy-cli#documentation) and have not found a suitable solution or answer.
- [x] I have searched the [issues](https://github.com/auth0/auth0-deploy-cli/issues) and have not found a suitable solution or answer.
- [x] I have upgraded to the [latest version](https://github.com/auth0/auth0-deploy-cli/releases/latest) of this tool and the issue still persists.
- [x] I have searched the [Auth0 Community](https://community.auth0.com/tag/auth0-deploy-cli) forums and have not found a suitable solution or answer.
- [x] I agree to the terms within the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md).

### Description

_TLDR: downgrade `a0deploy` to `8.7.1` and try again._

I'm posting this issue here after I received help from Auth0 support, since I couldn't find any mention of this issue already on GitHub or the community forums.

The issue occurs when running `a0deploy export` for some tenants. Part way through the process, there is error output that reads the following:
```
2025-04-28T06:49:50.953Z - error: Problem running command export
2025-04-28T06:49:50.954Z - error: Problem loading tenant data from Auth0 ManagementApiError: Please upgrade your subscription to enable Tenant ACL Management.
```

It seems that the release of tenant ACLs (still in early access) is causing the issue.

Here's what support told me, as well as the two workarounds:

> Since the feature is still in EA (Early Access) state which means it's not available for all the tenants, when the Deploy CLI tries to retrieve the configuration of this feature in your tenant where the feature is not enabled, it throws errors saying "Please upgrade your subscription to enable Tenant ACL Management.".
>
> My understanding is there are two possible workarounds to this:
>
> - The support of "Tenant Access Control List" feature is added to the latest version v8.8.0 of Auth0 Deploy CLI
https://github.com/auth0/auth0-deploy-cli/blob/master/CHANGELOG.md#880---2025-04-10
> You can downgrade the Auth0 Deploy CLI used in your GitLab pipeline to an older version.
>
> - Add "networkACLs" to the AUTH0_EXCLUDED settings of the config.json file of the deploy CLI
`{ "AUTH0_DOMAIN": "domain.eu.auth0.com", "AUTH0_CLIENT_ID": "<DEPLOY_CLI_CLIENT_ID>", // other settings omitted for brevity "AUTH0_EXCLUDED": ["networkACLs"] }`


### Expectation

I'd expect that breaking changes introduced to the `a0deploy` tool would result in a major version increment (ie I'd expect 8.7.1 and 8.8.0 to work the same).

### Reproduction

Given I have a tenant without tenant ACLs enabled (probably a production one?)
When I run a0deploy with v8.8.0.
I receive an error.

### Deploy CLI version

8.8.0

### Node version

20.18.1

Discussion:
@kushalshit27: Hi, 
@miccou , Thank you for reporting this issue!

 Is `DEPLOY_CLI_CLIENT_ID` (client) using network ACL permission?

> Add "networkACLs" to the AUTH0_EXCLUDED settings of the config.json file of the deploy CLI
{ "AUTH0_DOMAIN": "domain.eu.auth0.com", "AUTH0_CLIENT_ID": "<DEPLOY_CLI_CLIENT_ID>", // other settings omitted for brevity "AUTH0_EXCLUDED": ["networkACLs"] }

If you do not want to use network ACL, please uncheck the network ACL permission.

<img width="1065" alt="Image" src="https://github.com/user-attachments/assets/5fdafccf-cd60-4cee-bee7-2770ee94f19d" />

We are checking this; this should not block the `a0deploy export` flow. Thanks!@miccou: I checked our configuration, and the M2M application does have permissions for all the network_acls actions with the management API.

<img width="1027" alt="Image" src="https://github.com/user-attachments/assets/1b25d01c-74eb-46fa-9d75-fa7933152dd6" />@kushalshit27: If you do not want to use network ACL, please uncheck the network ACL permission. 

I would appreciate you test this out and if problem still persists, we can re-evaluate.  Thanks!@kushalshit27: Hi @miccou ,
The fix for this issue is now available in version [8.8.2](https://www.npmjs.com/package/auth0-deploy-cli/v/8.8.2). 🚀


Thank you for your patience! This issue has been resolved. Feel free to reopen it if you encounter any further problems.@miccou: Thanks!

Solution patch:
diff --git a/src/tools/auth0/handlers/networkACLs.ts b/src/tools/auth0/handlers/networkACLs.ts
index 5e78695..13792dd 100644
--- a/src/tools/auth0/handlers/networkACLs.ts
+++ b/src/tools/auth0/handlers/networkACLs.ts
@@ -234,6 +234,12 @@ export default class NetworkACLsHandler extends DefaultAPIHandler {
       if (err.statusCode === 404 || err.statusCode === 501) {
         return null;
       }
+      if (err.statusCode === 403) {
+        log.debug(
+          'Tenant ACL Management is not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.'
+        );
+        return null;
+      }
       throw err;
     }
   }



Test patch:
diff --git a/test/tools/auth0/handlers/networkACLs.test.ts b/test/tools/auth0/handlers/networkACLs.test.ts
index d572a3c..9ec4200 100644
--- a/test/tools/auth0/handlers/networkACLs.test.ts
+++ b/test/tools/auth0/handlers/networkACLs.test.ts
@@ -111,6 +111,18 @@ describe('#networkACLs handler', () => {
       expect(data).to.deep.equal([sampleNetworkACL]);
     });
 
+    it('should handle 403 error when tenant ACL Management is not enabled', async () => {
+      const auth0 = {
+        networkAcls: {
+          getAll: () => Promise.reject(Object.assign(new Error('Forbidden'), { statusCode: 403 })),
+        },
+      };
+
+      const handler = new NetworkACLsHandler({ client: pageClient(auth0 as any), config } as any);
+      const data = await handler.getType();
+      expect(data).to.equal(null);
+    });
+
     it('should update networkACLs', async () => {
       const auth0 = {
         networkAcls: {