FlowiseAI/Flowise · error · InternalFlowiseError

Error: credentialsController.revealCredentialById - workspac

Error message

Error: credentialsController.revealCredentialById - workspace ${workspaceId} not found!

What it means

Thrown by revealCredentialById when req.user.activeWorkspaceId is falsy. Because this endpoint returns decrypted secrets, hitting it without a workspace claim is both a functionality failure and a signal that the auth claim is incomplete. Returns HTTP 404.

Source

Thrown at packages/server/src/controllers/credentials/index.ts:93

        }
        const apiResponse = await credentialsService.getCredentialById(req.params.id, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const revealCredentialById = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: credentialsController.revealCredentialById - id not provided!`
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,
                `Error: credentialsController.revealCredentialById - workspace ${workspaceId} not found!`
            )
        }
        const apiResponse = await credentialsService.revealCredentialById(req.params.id, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const updateCredential = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: credentialsController.updateCredential - id not provided!`
            )

View on GitHub (pinned to abe4a8601a)

Solutions

Re-authenticate the user to mint a JWT that includes activeWorkspaceId.
Verify workspace membership and re-add the user if they were removed.
On the client, only enable the Reveal button after confirming loggedInUser.activeWorkspaceId is present.
For tests, set req.user.activeWorkspaceId explicitly.

Example fix

// client gate
const canReveal = Boolean(loggedInUser?.activeWorkspaceId && selectedCredentialId)
<Button disabled={!canReveal} onClick={reveal}>Reveal</Button>

Defensive patterns

Strategy: validation

Validate before calling

// gate reveal on BOTH id and workspace
const canReveal =
  typeof selectedId === 'string' && selectedId.length > 0
  && typeof currentUser?.activeWorkspaceId === 'string'

if (canReveal) {
  await api.revealCredentialById(selectedId)
}

Type guard

function hasActiveWorkspace(u: unknown): u is { activeWorkspaceId: string } {
  return typeof u === 'object' && u !== null
    && typeof (u as any).activeWorkspaceId === 'string'
    && (u as any).activeWorkspaceId.length > 0
}

Try / catch

try {
  await api.revealCredentialById(id)
} catch (e) {
  if (e.status === 404 && /workspace .* not found/.test(e.message)) {
    await auth.relogin()
  } else throw e
}

Prevention

Treat the reveal endpoint as privileged — re-check the workspace claim client-side before calling.
Auto-disable Reveal when the session is about to expire; refresh tokens first.
Audit logs for repeated 404s on reveal — it may indicate token-rotation bugs.

When it happens

Trigger: GET /api/v1/credentials/:id/reveal with a valid id but a JWT/session lacking activeWorkspaceId. Common right after login if the credentials page auto-reveals on mount.

Common situations: User joined a workspace after their JWT was issued. SSO flow that doesn't propagate workspace. Cookie cleared mid-session. Token minted by a backdoor/test script with no workspace claim.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/b431e68472e435c3. Report an issue: GitHub.