Error 403 when Uploading Source Strings via wlc (--method replace)

[ddeveloperuch]

Hello Weblate Team,
I'm using the Python Weblate Client (wlc) to interact with our Weblate instance (5.13.3).
The source language for our component is configured as English (Developer). I'm attempting to upload updated source strings using the -method replace flag. However, I'm encountering the following errors:

DEBUG:wlc:[
 "post",
 "https://weblate.companyXYZ.com/app-ios-project/en_devel/file/",
 {
  "headers": {
   "user-agent": "wlc/1.15",
   "Accept": "application/json",
   "Authorization": "Token wlu_abcdefg1234567890abcdefg"
  },
  "verify": true,
  "allow_redirects": false,
  "data": {
   "method": "replace"
  },
  "timeout": 300
 }
]
send: b'POST.....
reply: 'HTTP/1.1 403 Forbidden\r\n'
........
header: Content-Encoding: gzip
DEBUG:urllib3.connectionpool:https://weblate.companyXYZ.com:443 "POST /api/translations/companyXYZ/app-ios-project/en_devel/file/ HTTP/1.1" 403 None
Error: You don't have permission to access this object.
{
  "status": "❌ Failed to upload en.xliff",
  "details": {
    "command": [
      "wlc",
      "--debug",
      "--url",
      "https://weblate.companyXYZ.com/api/",
      "--key",
      "wlu_abcdefg1234567890abcdefg",
      "upload",
      "companyXYZ/app-ios-project/en_devel",
      "--input",
      "_Translations/en.xliff",
      "--method",
      "replace"
    ],
    "exit_status": 1
  }
}

The user is an administrator and already has the full set of permissions. It’s unclear what other permissions are being referred to.

Here are the logs from Weblate.

AA.BB.CC.DD - - [09/Oct/2025:11:46:29 +0000] "GET /api/translations/companyXYZ/app-ios-project/en_devel/ HTTP/1.0" 200 6690 "-" "wlc/1.15"
AA.BB.CC.DD - - [09/Oct/2025:11:46:29 +0000] "POST /api/translations/companyXYZ/app-ios-project/en_devel/file/ HTTP/1.0" 403 144 "-" "wlc/1.15"
AA.BB.CC.DD - - [09/Oct/2025:11:46:33 +0000] "GET /api/translations/companyXYZ/app-ios-project/en_devel/ HTTP/1.0" 200 6690 "-" "wlc/1.15"
AA.BB.CC.DD - - [09/Oct/2025:11:46:33 +0000] "POST /api/translations/companyXYZ/app-ios-project/en_devel/file/ HTTP/1.0" 403 144 "-" "wlc/1.15"
AA.BB.CC.DD - - [09/Oct/2025:11:46:36 +0000] "GET /api/translations/companyXYZ/app-ios-project/en_devel/ HTTP/1.0" 200 6690 "-" "wlc/1.15"
AA.BB.CC.DD - - [09/Oct/2025:11:46:36 +0000] "POST /api/translations/companyXYZ/app-ios-project/en_devel/file/ HTTP/1.0" 403 144 "-" "wlc/1.15"

I tested both with my personal API key and with the project token (which has all permissions), but the result is the same - You don’t have permission to access this object.

The initial thread can be found here.

[nijel]

How is the translation component configured? Does it allow editing of source strings?

[ddeveloperuch]

@nijel Is there any workaround to replace XLIFF-based source strings without having to recreate the entire repository?

[nijel]

You can use replace upload on the individual translation to update that.

[nijel]

Created #16691 to track this feature request.

[ddeveloperuch]

@nijel My use case involves a situation where a certain set of strings is no longer used, and a completely new set of strings has been introduced. In such cases, the native replace upload typically handles this transition well. Could you please clarify how this scenario would be managed when using the replace upload option for an individual translation?

[nijel]

How would you handle this without Weblate? If you have an existing workflow, you can download the files, apply the workflow and upload it back.

[nijel]

Actually the HTTP response contains a more detailed error, but it turns out that wlc doesn't show it. WeblateOrg/wlc#971 addresses that.