CPF2207: Not authorized to use object

What it means

CPF2207 is a message from QCPFMSG with the text "Not authorized to use object &1 in library &3 type *&2". It reports an authority failure, like CPF9802 and CPF2189, and is sent by a different set of commands. You see it most with commands that work on authority itself, such as GRTOBJAUT, and with work on output queues and spooled files.

Changing an object's authority has its own rules. The object's owner can grant any authority. A user with *ALLOBJ special authority can too. A user with object management authority to the object can grant the rights they hold, except object management itself. Anyone else who tries gets refused.

Output queues add another twist. An output queue created with AUTCHK(*OWNER) only lets the queue's owner, or a user with *SPLCTL special authority, manage other users' spooled files on it. Other users get CPF2207 even when *PUBLIC appears to have plenty of authority to the queue.

Common causes

• A user who isn't the owner, has no *ALLOBJ and lacks object management authority tried to grant or revoke authority to the object.
• A user tried to hold, release, move or delete spooled files on an output queue that checks authority by owner (AUTCHK(*OWNER)).
• The object's *PUBLIC authority is too low and the user has no private or group authority to it.
• The object was re-created or restored with different owner or authority settings.
• The command runs under a different user profile than expected, such as a submitted batch job.

How to find the problem

1. Open the job log with DSPJOBLOG, put the cursor on CPF2207 and press F1. The help names the object, library and type. The command logged before it shows what was attempted.
2. Run DSPOBJAUT OBJ(ACCTLIB/PAYMAST) OBJTYPE(*FILE) to see the owner and who holds which authority.
3. For an output queue, run WRKOUTQD on it and check the AUTCHK and OPRCTL values.
4. Run DSPUSRPRF for the user to see group profiles and special authorities such as *ALLOBJ and *SPLCTL.

How to fix it

• Let the object's owner or a security officer make the authority change, or give the user the authority they need on the object.
• For an output queue, change it to check data authority with CHGOUTQ OUTQ(ACCTLIB/PRT01) AUTCHK(*DTAAUT), and give the users *READ, *ADD and *DLT authority to the queue. IBM's support note for this case describes the same fix.
• Grant to a group profile or authorization list rather than single users, so the next new user only needs the right group.
• Avoid handing out *ALLOBJ or *SPLCTL to get past one message. Both reach far beyond one object.

What it looks like

Not authorized to use object PRT01 in library ACCTLIB type *OUTQ.

DSPMSGD MSGID(CPF2207) MSGF(QSYS/QCPFMSG)

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your IBM i release.