FlowiseAI/Flowise · error · InternalFlowiseError

Workspace ID is required

Error message

Workspace ID is required

What it means

Thrown by deleteApiKey after the id guard passes, when req.user?.activeWorkspaceId is falsy. Unusually for a workspace check in this codebase it uses HTTP 412 (PRECONDITION_FAILED) with the bare message 'Workspace ID is required' (no controller prefix), whereas the assistants and chat-messages controllers throw 404 NOT_FOUND for the same condition. The active workspace id is attached to req.user by the auth/session middleware from the JWT/session; if that claim is absent the delete cannot be scoped to a workspace and is rejected.

Source

Thrown at packages/server/src/controllers/apikey/index.ts:83

                `Error: apikeyController.updateApiKey - permissions must be an array of strings!`
            )
        }
        const user = req.user as LoggedInUser
        const apiResponse = await apikeyService.updateApiKey(user, req.params.id, req.body.keyName, req.body.permissions)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

// Delete api key
const deleteApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.id) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: apikeyController.deleteApiKey - id not provided!`)
        }
        if (!req.user?.activeWorkspaceId) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Workspace ID is required`)
        }
        const apiResponse = await apikeyService.deleteApiKey(req.params.id, req.user?.activeWorkspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

// Verify api key
const verifyApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (typeof req.params === 'undefined' || !req.params.apikey) {
            throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: apikeyController.verifyApiKey - apikey not provided!`)
        }
        const apiResponse = await apikeyService.verifyApiKey(req.params.apikey)
        return res.json(apiResponse)
    } catch (error) {
        next(error)

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Have the client select/switch to an active workspace first (the workspace switch endpoint) so the session carries activeWorkspaceId, then retry the delete.
  2. Verify the auth middleware populates req.user (including activeWorkspaceId) from the token before this router runs.
  3. Confirm the user record actually has a workspace membership in the database; recreate the membership if it was removed.
  4. Note the status-code inconsistency (412 here vs 404 elsewhere) if you centralize error handling on status.

Example fix

// before: delete attempted before a workspace is selected
await fetch(`${BASE}/api/v1/apikey/${id}`, { method: 'DELETE', headers })

// after: ensure an active workspace is set in the session first
await selectWorkspace(activeWorkspaceId) // sets activeWorkspaceId claim in session/JWT
await fetch(`${BASE}/api/v1/apikey/${id}`, { method: 'DELETE', headers })
Defensive patterns

Strategy: try-catch

Type guard

// If the client tracks the logged-in user shape:
const hasActiveWorkspace = (u: unknown): u is { activeWorkspaceId: string } =>
  !!u && typeof u === 'object' &&
  typeof (u as any).activeWorkspaceId === 'string' &&
  (u as any).activeWorkspaceId.length > 0

Try / catch

try {
  await deleteApiKey(id)
} catch (err) {
  // 412 'Workspace ID is required' (or 404 'workspace' elsewhere)
  if (err?.statusCode === 412 && /workspace id is required/i.test(err.message)) {
    await selectWorkspace() // re-establish activeWorkspaceId in the session
    return deleteApiKey(id) // retry once
  }
  throw err
}

Prevention

When it happens

Trigger: Authenticated DELETE /api/v1/apikey/<id> where the session/JWT carries no activeWorkspaceId — the user has no active workspace selected, the auth middleware did not populate req.user.activeWorkspaceId, or the user has no workspace membership.

Common situations: Newly provisioned user who never completed workspace selection/creation; JWT minted without the workspace claim; auth middleware misconfigured or bypassed in a custom deployment; the user's workspace membership was deleted from the DB while their session remained valid.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/472404db3e9d3418. Report an issue: GitHub.