FlowiseAI/Flowise · warning · InternalFlowiseError

Error: apikeyController.deleteApiKey - id not provided!

Error message

Error: apikeyController.deleteApiKey - id not provided!

What it means

Thrown by the Flowise apikey controller's deleteApiKey handler as an InternalFlowiseError with HTTP 412 (PRECONDITION_FAILED). It fires when the request reaches the handler with no id path parameter, i.e. req.params is undefined or req.params.id is falsy. The DELETE route is registered for both '/' and '/:id' (routes/apikey/index.ts:16), so hitting the root path without an id segment lands here. The error is forwarded via next(error) to Express's error middleware, which serializes it as the HTTP response.

Source

Thrown at packages/server/src/controllers/apikey/index.ts:80

        ) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: apikeyController.updateApiKey - permissions must be an array of strings!`
            )
        }
        const user = req.user as LoggedInUser
        const apiResponse = await apikeyService.updateApiKey(user, req.params.id, req.body.keyName, req.body.permissions)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

// Delete api key
const deleteApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: apikeyController.deleteApiKey - id not provided!`)
        }
        if (!req.user?.activeWorkspaceId) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Workspace ID is required`)
        }
        const apiResponse = await apikeyService.deleteApiKey(req.params.id, req.user?.activeWorkspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

// Verify api key
const verifyApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.apikey) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: apikeyController.verifyApiKey - apikey not provided!`)
        }
        const apiResponse = await apikeyService.verifyApiKey(req.params.apikey)

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Call DELETE with a concrete id: DELETE /api/v1/apikey/<id> (never the bare root) — the '/:id' route variant is the one that actually deletes.
  2. Guard the id client-side before building the URL: if id is not a non-empty string, abort the request.
  3. If you operate a proxy/gateway in front of Flowise, confirm it preserves the full path including the final id segment.

Example fix

// before
await fetch(`${BASE}/api/v1/apikey/`, { method: 'DELETE', headers })

// after
if (typeof id !== 'string' || id.trim() === '') throw new Error('id required')
await fetch(`${BASE}/api/v1/apikey/${encodeURIComponent(id)}`, { method: 'DELETE', headers })
Defensive patterns

Strategy: validation

Validate before calling

function assertId(id: unknown): string {
  if (typeof id !== 'string' || id.trim() === '') {
    throw new Error('apikey id is required')
  }
  return id
}
const id = assertId(selectedId)
await fetch(`${BASE}/api/v1/apikey/${encodeURIComponent(id)}`, { method: 'DELETE', headers })

Type guard

const isNonEmptyString = (v: unknown): v is string =>
  typeof v === 'string' && v.trim().length > 0

Prevention

When it happens

Trigger: Calling DELETE /api/v1/apikey/ (root form, no id segment) rather than DELETE /api/v1/apikey/<id>. A client building the URL from an empty/blank variable such that the final segment is omitted, or an ingress/proxy that strips the trailing path segment. Note: sending the literal string 'undefined' (DELETE /api/v1/apikey/undefined) does NOT trigger this because req.params.id would be the truthy string 'undefined'.

Common situations: A frontend 'Delete API key' action fired before a row is selected, so the id variable is empty and the URL collapses to the root. Misconfigured reverse proxy or base-URL normalization that drops the trailing segment. Automated test/cleanup scripts that iterate an empty id list and DELETE the collection root.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/c725d3286453428c. Report an issue: GitHub.