FlowiseAI/Flowise · error · InternalFlowiseError

Error: credentialsController.updateCredential - workspace ${

Error message

Error: credentialsController.updateCredential - workspace ${workspaceId} not found!

What it means

Thrown by updateCredential when req.user.activeWorkspaceId is falsy — the third and last guard in the handler, after id and body. Same auth-claim root cause as 780/781/783/785. Returns HTTP 404.

Source

Thrown at packages/server/src/controllers/credentials/index.ts:121

}

const updateCredential = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: credentialsController.updateCredential - id not provided!`
            )
        }
        if (!req.body) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: credentialsController.updateCredential - body not provided!`
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,
                `Error: credentialsController.updateCredential - workspace ${workspaceId} not found!`
            )
        }
        const apiResponse = await credentialsService.updateCredential(req.params.id, req.body, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

export default {
    createCredential,
    deleteCredentials,
    getAllCredentials,
    getCredentialById,
    revealCredentialById,
    updateCredential

View on GitHub (pinned to abe4a8601a)

Solutions

Re-login to obtain a JWT that includes activeWorkspaceId.
Verify the user still belongs to a workspace; restore membership if removed.
Call the workspace-switch endpoint before the update if the user has multiple workspaces.
In tests, set req.user.activeWorkspaceId in the auth stub.

Example fix

// before — stale token reused
await api.updateCredential(id, payload)

// after — refresh auth first
if (!currentUser.activeWorkspaceId) {
  await reauthenticate()
}
await api.updateCredential(id, payload)

Defensive patterns

Strategy: validation

Validate before calling

function assertActiveWorkspace(user: unknown): string {
  const ws = (user as any)?.activeWorkspaceId
  if (typeof ws !== 'string' || ws.length === 0) {
    throw new Error('no activeWorkspaceId — re-login required')
  }
  return ws
}

assertActiveWorkspace(currentUser)
await api.updateCredential(id, payload)

Type guard

function hasActiveWorkspace(u: unknown): u is { activeWorkspaceId: string } {
  return typeof u === 'object' && u !== null
    && typeof (u as any).activeWorkspaceId === 'string'
    && (u as any).activeWorkspaceId.length > 0
}

Try / catch

try {
  await api.updateCredential(id, payload)
} catch (e) {
  if (e.status === 404 && /workspace .* not found/.test(e.message)) {
    await auth.relogin()
  } else throw e
}

Prevention

Re-mint the JWT whenever the user's workspace set changes (invite accepted, workspace switched).
On the client, validate id, body, and workspace claim together before issuing an update.
In tests, use a shared auth fixture that always sets activeWorkspaceId.

When it happens

Trigger: PUT /api/v1/credentials/:id with a valid id and body, but the JWT/session lacks activeWorkspaceId. Triggered on the credentials edit-save flow when the user's session lost its workspace binding.

Common situations: Stale token after workspace reassignment. SSO login that didn't set the workspace claim. OSS-to-enterprise build switch with an old cookie. Test harness using a token without workspace claims.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/5e310a85dfff10a4. Report an issue: GitHub.