API Error 'insufficient access rights on cross-reference id'

The following six scenarios describe documented causes of the "insufficient access rights on cross-reference id" error, with possible causes and resolution steps. Note: This error may also occur for new or undocumented causes not listed here.

Scenario 1: Creating a Record and Assigning It to a New User in the Same API Call

Possible Cause: You cannot assign a record to a new user in the same API call that creates the record.
Resolution: Create the record first. Then, in a separate API call, update the record with the new OwnerId.

Scenario 2: Invalid Record Type ID for the Object Being Manipulated

Possible Cause: The record type ID used in the call is not a valid record type for the target object.
Resolution: Correct the Record Type ID to a valid value for the object.

Scenario 3: Assigning a Record to a User Without Profile Access to the Record Type

Possible Cause: The user being assigned does not have profile-level access to the record type used.
Resolution: Add the record type to the user's profile.

Scenario 4: Assigning User's Profile Does Not Have Access to the Record Type

Possible Cause: The assigning user's profile does not have access to the record type being used.
Resolution: Add the record type to the assigning user's profile.

Scenario 5: Assigning a Record to a Partner Portal User Without Community Access

Possible Cause: The Partner Portal user does not have access to the internal Salesforce record or community scope.
Resolution: Add a NetworkScope column to the API call, including the ID for the Community you are working with.

Scenario 6: Lead Auto-Response Email Template in an Inaccessible Folder

Possible Cause: A lead submission invokes an auto-response email notification, but the email template is in a folder the submitting user cannot access.
Resolution: Identify the email template invoked in the auto-response rule. Check the folder permissions for the folder containing that template. Ensure the user making the API call has access to the folder.

General Rule

If none of the above scenarios apply, consider any possibility where a record associated with your action — referenced directly in the API call, or by any resulting trigger, workflow, or auto-response — must be accessible by the user making the API call.