Describe the bug
The "Import Jellyfin Users to Seerr" and "Sync Jellyseerr Watchlist to Jellyfin" scheduled tasks both fail with a 403 Forbidden error when Seerr 3.2.0 is used. The bulk import task calls /api/v1/user which Seerr 3.2.0 has restricted to require a full authenticated session cookie — API key authentication alone is no longer sufficient for this endpoint. Just-in-time user import works correctly as a fallback.
Expected behavior
Both scheduled tasks should complete successfully. Users should be bulk-imported into Seerr periodically without manual intervention.
Jellyfin Environment:
Logs
[ERR] Error executing Scheduled Task
System.MissingMethodException: Method not found: 'System.Collections.Generic.IEnumerable`1<Jellyfin.Database.Implementations.Entities.User> MediaBrowser.Controller.Library.IUserManager.get_Users()'
at Jellyfin.Plugin.JellyfinEnhanced.ScheduledTasks.JellyseerrUserImportTask.ExecuteAsync(IProgress`1 progress, CancellationToken cancellationToken)
[WRN] Seerr validate failed for http://seerr:5055/: code=Forbidden status=403 cf-ray= — Seerr returned 403. Common causes: API key rotated, user lacks permission, or CSRF protection enabled in Seerr.
Direct API test confirming the restriction:
Invoke-RestMethod -Uri "http://192.168.1.31:5055/api/v1/user" -Headers @{"X-Api-Key" = "[redacted]"}
→ {"status":403,"error":"You do not have permission to access this endpoint"}
Seerr /api/v1/status responds correctly with the same API key, confirming the key itself is valid. The /api/v1/user endpoint specifically requires a session cookie in Seerr 3.2.0.
Additional context
Seerr 3.2.0 (the successor to Jellyseerr) appears to have tightened permissions on the /api/v1/user endpoint so that API key authentication is no longer sufficient — a full user session is required. The plugin's server-side scheduled tasks run without a user session, so they cannot access this endpoint. Just-in-time import (triggered when a user interacts with Seerr Search) works correctly as it runs in a user context. All three Jellyfin users were successfully auto-imported via just-in-time import.
Describe the bug
The "Import Jellyfin Users to Seerr" and "Sync Jellyseerr Watchlist to Jellyfin" scheduled tasks both fail with a 403 Forbidden error when Seerr 3.2.0 is used. The bulk import task calls
/api/v1/userwhich Seerr 3.2.0 has restricted to require a full authenticated session cookie — API key authentication alone is no longer sufficient for this endpoint. Just-in-time user import works correctly as a fallback.Expected behavior
Both scheduled tasks should complete successfully. Users should be bulk-imported into Seerr periodically without manual intervention.
Jellyfin Environment:
Logs
Direct API test confirming the restriction:
Seerr
/api/v1/statusresponds correctly with the same API key, confirming the key itself is valid. The/api/v1/userendpoint specifically requires a session cookie in Seerr 3.2.0.Additional context
Seerr 3.2.0 (the successor to Jellyseerr) appears to have tightened permissions on the
/api/v1/userendpoint so that API key authentication is no longer sufficient — a full user session is required. The plugin's server-side scheduled tasks run without a user session, so they cannot access this endpoint. Just-in-time import (triggered when a user interacts with Seerr Search) works correctly as it runs in a user context. All three Jellyfin users were successfully auto-imported via just-in-time import.