Specific RPA requires Job View permissions and cannot be invoked from Maestro

Japan Knowledge Base
,
1

:white_question_mark: Question
When calling RPA workflows in the Orchestrator folder from Maestro, some workflows may fail to start with the following 403 error. Even if other RPA workflows called within the same Maestro process start normally, additional folder permissions may be required due to the size of the input arguments passed to the target workflow or the processing on the Orchestrator side. This issue can occur when the JSON arguments passed from Maestro to the target RPA workflow exceed 10,000 characters, requiring job attachment processing on the Orchestrator side.

Error
{ "code": "403", "message": "Failure to start the Orchestrator job", "detail": "Operation returned invalid status code '403'. You don't have permissions to view jobs in this folder.", "category": "User", "status": 403, "element": "<RPA workflow name>" }

:light_bulb: Answer
Cause
If the JSON arguments passed from Maestro to the RPA workflow exceed 10,000 characters, processing occurs on the Orchestrator side that treats it as a job attachment. Processing job attachments requires Jobs.View permissions for the target Orchestrator folder. If the executing account has Jobs.Create permission, it can create the job itself. However, if Jobs.View permission is insufficient during job attachment processing, a 403 error Failure to start the Orchestrator job / You don't have permissions to view jobs in this folder. may occur. Even for the same RPA workflow, if the input arguments are within 10,000 characters such that no job attachment is generated, the process may start successfully without requiring Jobs.View permissions.

Solution
Please check the following steps:

  1. Verify the size of the input arguments being passed from Maestro to the RPA workflow with errors.

  2. If the JSON arguments may exceed 10,000 characters, grant Jobs.View permissions on the target Orchestrator folder to the account executing the specified RPA workflow from Maestro.

  3. If the impact of existing roles is extensive, create a dedicated role for Maestro execution and only grant the necessary permissions for the target folder.

  4. If a successful revalidation occurs without Jobs.View permissions, check whether the input arguments passed during that execution were within 10,000 characters. If they were within this limit, the job attachment would not be generated, and thus the process not requiring Jobs.View permissions is expected behavior.

  5. Even if you are updating the version of Robot / Studio, the behavior requiring job attachments on the Orchestrator side for input arguments exceeding 10,000 characters, and the need for Jobs.View permissions for that processing, remain unchanged.