FlowiseAI/Flowise · error · InternalFlowiseError

Error: chatflowsController.clearWebhookSecret - workspace no

Error message

Error: chatflowsController.clearWebhookSecret - workspace not found!

What it means

Thrown by clearWebhookSecret when req.user?.activeWorkspaceId is falsy. Like setWebhookSecret it returns UNAUTHORIZED (401) rather than the NOT_FOUND used elsewhere — a deliberate or accidental status-code divergence. The operation is workspace-scoped and cannot run without that context.

Source

Thrown at packages/server/src/controllers/chatflows/index.ts:331

        }
        const apiResponse = await chatflowsService.setWebhookSecret(req.params.id, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const clearWebhookSecret = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (!req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: chatflowsController.clearWebhookSecret - id not provided!`
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(StatusCodes.UNAUTHORIZED, `Error: chatflowsController.clearWebhookSecret - workspace not found!`)
        }
        await chatflowsService.clearWebhookSecret(req.params.id, workspaceId)
        return res.sendStatus(StatusCodes.NO_CONTENT)
    } catch (error) {
        next(error)
    }
}

const getScheduleStatus = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (!req.params?.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                'Error: chatflowsController.getScheduleStatus - id not provided!'
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {

View on GitHub (pinned to abe4a8601a)

Solutions

Re-authenticate and resend with a valid session/API key.
Ensure the user has an active workspace before attempting to clear the secret.
Mirror the auth middleware used by sibling chatflow routes.

Example fix

// before
await fetch(`/api/v1/chatflows/${id}/webhook-secret`, { method: 'DELETE' })
// after
await fetch(`/api/v1/chatflows/${id}/webhook-secret`, {
  method: 'DELETE',
  headers: { Cookie: sessionCookie }
})

Defensive patterns

Strategy: validation

Validate before calling

async function authedDelete(url: string) {
  if (!token) throw new Error('no auth token - cannot resolve active workspace')
  return fetch(url, { method: 'DELETE', headers: { Authorization: `Bearer ${token}` } })
}

Type guard

const hasActiveWorkspace = (u: unknown): u is { activeWorkspaceId: string } =>
  !!u && typeof (u as any).activeWorkspaceId === 'string'

Try / catch

try { await api.clearWebhookSecret(id) } catch (e) { if (e.statusCode === 401) { await reAuth(); await api.clearWebhookSecret(id) } else throw e }

Prevention

Re-authenticate on 401 before retrying.
Ensure the user has an active workspace.
Verify auth middleware on the route.

When it happens

Trigger: Unauthenticated request, expired session, or an authenticated user whose activeWorkspaceId is not set. Same root cause family as the other workspace guards but flagged as 401.

Common situations: Token expiry between page load and the action, a 401-gated flow that did not re-auth, or test code that omits req.user.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/ffe159c56e9f0a11. Report an issue: GitHub.