FlowiseAI/Flowise · warning · InternalFlowiseError

Error: credentialsController.revealCredentialById - id not p

Error message

Error: credentialsController.revealCredentialById - id not provided!

What it means

Thrown by revealCredentialById when req.params.id is missing or empty. revealCredentialById is the sensitive endpoint that decrypts credential secrets, so it guards id first. Identical shape to the other id-not-provided errors. Returns HTTP 412 PRECONDITION_FAILED.

Source

Thrown at packages/server/src/controllers/credentials/index.ts:86

        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,
                `Error: credentialsController.getCredentialById - workspace ${workspaceId} not found!`
            )
        }
        const apiResponse = await credentialsService.getCredentialById(req.params.id, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const revealCredentialById = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: credentialsController.revealCredentialById - id not provided!`
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,
                `Error: credentialsController.revealCredentialById - workspace ${workspaceId} not found!`
            )
        }
        const apiResponse = await credentialsService.revealCredentialById(req.params.id, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

View on GitHub (pinned to abe4a8601a)

Solutions

Confirm the request URL contains a real UUID in the id position (check the network tab).
On the client, only call reveal when a credential is selected and its id is a non-empty string.
Gate the reveal action behind a user gesture (button click) that always has the row's id in scope.
Verify the route registration includes :id (e.g. app.get('/credentials/:id/reveal', ...)).

Example fix

// before
const reveal = () => api.revealCredentialById(selectedId) // selectedId may be null

// after
const reveal = () => {
  if (!selectedId) return // no-op when nothing selected
  return api.revealCredentialById(selectedId)
}

Defensive patterns

Strategy: type-guard

Validate before calling

function requireCredentialId(id: unknown): string {
  if (typeof id !== 'string' || id.trim().length === 0) {
    throw new Error('credential id required before reveal')
  }
  return id
}

const id = requireCredentialId(selectedCredentialId)
await api.revealCredentialById(id)

Type guard

function isNonEmptyString(v: unknown): v is string {
  return typeof v === 'string' && v.length > 0
}

Try / catch

try {
  await api.revealCredentialById(id)
} catch (e) {
  if (e.status === 412 && /id not provided/.test(e.message)) {
    // caller bug — surface to the user as 'select a credential first'
    notify('Select a credential first')
    return
  }
  throw e
}

Prevention

Only render the Reveal button when a row is selected with a non-empty id.
Bind reveal actions to a user gesture that carries the row's id, not to a global state that may be null.
URL-encode the id when interpolating into the request path.

When it happens

Trigger: GET /api/v1/credentials/:id/reveal (or equivalent) called with no id segment, an empty id, or a literal 'undefined'/'null' string in the URL.

Common situations: Frontend reveals a credential before one is selected in the UI (selectedCredential is null). Misconfigured route that drops :id. Programmatic client reusing a stale id variable.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/ad1a024bf07e6005. Report an issue: GitHub.