ComposioHQ/composio · error · ComposioAclOnlyForSharedError

${error.message (upstream BadRequestError: ACL only allowed

Error message

${error.message (upstream BadRequestError: ACL only allowed for shared connections)}

What it means

The backend rejected the ACL update with a BadRequestError indicating ACL is only allowed for shared connections; the SDK re-maps this to the more specific ComposioAclOnlyForSharedError so callers can handle it precisely.

Source

Thrown at ts/packages/core/src/models/Experimental.ts:123

      cause: parsedParams.error,
    });
  }

  const body: ConnectedAccountPatchParams = {
    experimental: {
      acl_config_for_shared: serializeAclConfigForWire(parsedParams.data),
    },
  };

  try {
    return await client.connectedAccounts.patch(nanoid, body);
  } catch (error) {
    if (
      error instanceof BadRequestError &&
      typeof error.message === 'string' &&
      error.message.includes(ACL_ONLY_FOR_SHARED_ERROR_FRAGMENT)
    ) {
      throw new ComposioAclOnlyForSharedError(error.message, { cause: error });
    }
    throw error;
  }
}

export class Experimental {
  private client: ComposioClient;

  constructor(client: ComposioClient) {
    this.client = client;
    telemetry.instrument(this, 'Experimental');
  }

  /**
   * Compatibility alias for `composio.connectedAccounts.updateAcl(...)`.
   * Update the per-user ACL on a SHARED connected account.
   * **Experimental — shape may change in future releases.**
   *

View on GitHub (pinned to 64b1b85502)

Solutions

Verify the connected account is a shared connection before calling updateAcl
Recreate the connection as a shared connection if ACL management is required
Catch ComposioAclOnlyForSharedError specifically and skip/handle non-shared accounts

Example fix

// before
await account.updateAcl({ enabled: true });
// after
if (account.connectionType === 'shared') {
  await account.updateAcl({ enabled: true });
}

Defensive patterns

Strategy: try-catch

Validate before calling

if (account.connectionType !== 'shared') { throw new Error('skip ACL: not a shared connection'); }

Try / catch

try { await account.updateAcl(params); } catch (e) { if (e instanceof ComposioAclOnlyForSharedError) { /* skip or convert to shared */ return; } throw e; }

Prevention

Check the connection's shared flag before calling updateAcl
Listen for ComposioAclOnlyForSharedError as a control-flow signal
Keep ACL management flows separate from per-user account flows

When it happens

Trigger: Calling updateAcl on a connected account that is not a shared connection — the API returns 400 with a message containing the 'ACL only allowed for shared connections' fragment, which updateConnectedAccountAcl catches and rethrows as ComposioAclOnlyForSharedError.

Common situations: Applying ACL controls to a per-user connected account created normally; promoting a shared-connections feature onto existing accounts; backend policy changes on which connections support ACL.

Related errors

AI-assisted analysis of ComposioHQ/composio@64b1b85502 (2026-08-28). Data as JSON: /api/errors/657871868f03da80. Report an issue: GitHub.