FlowiseAI/Flowise · error · InternalFlowiseError

You do not have permission to delete any chatflow types

Error message

You do not have permission to delete any chatflow types

What it means

Thrown by deleteChatflow when a non-org-admin user lacks every chatflow-delete permission (chatflows:delete, agentflows:delete, assistants:delete). Returns FORBIDDEN (403). This is an intentional RBAC denial, not a validation or auth-context failure — the user is known but is not allowed to delete any chatflow type.

Source

Thrown at packages/server/src/controllers/chatflows/index.ts:82

            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,
                `Error: chatflowsController.deleteChatflow - workspace ${workspaceId} not found!`
            )
        }
        const userPermittedTypes: EnumChatflowType[] = []
        const permissions = req.user!.permissions
        if (req.user?.isOrganizationAdmin) {
            userPermittedTypes.push(EnumChatflowType.CHATFLOW)
            userPermittedTypes.push(EnumChatflowType.AGENTFLOW)
            userPermittedTypes.push(EnumChatflowType.MULTIAGENT)
            userPermittedTypes.push(EnumChatflowType.ASSISTANT)
        } else {
            if (permissions.includes(`chatflows:delete`)) userPermittedTypes.push(EnumChatflowType.CHATFLOW)
            if (permissions.includes(`agentflows:delete`)) userPermittedTypes.push(EnumChatflowType.AGENTFLOW)
            if (permissions.includes(`agentflows:delete`)) userPermittedTypes.push(EnumChatflowType.MULTIAGENT)
            if (permissions.includes(`assistants:delete`)) userPermittedTypes.push(EnumChatflowType.ASSISTANT)
            if (userPermittedTypes.length === 0)
                throw new InternalFlowiseError(StatusCodes.FORBIDDEN, `You do not have permission to delete any chatflow types`)
        }
        const apiResponse = await chatflowsService.deleteChatflow(req.params.id, orgId, workspaceId, userPermittedTypes)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const getAllChatflows = async (req: Request, res: Response, next: NextFunction) => {
    try {
        const { page, limit } = getPageAndLimitParams(req)

        const apiResponse = await chatflowsService.getAllChatflows(
            req.query?.type as ChatflowType,
            req.user?.activeWorkspaceId,
            page,
            limit
        )

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Grant the user a role containing chatflows:delete (and/or agentflows:delete, assistants:delete) via the org admin UI.
  2. If the user is supposed to be an org admin, verify isOrganizationAdmin is true in their current token — re-login if the role changed.
  3. Confirm the permission strings in the role definition match exactly (chatflows:delete, etc.).
  4. Have an admin perform the delete, or use a service account with the correct scope.

Example fix

// before: viewer role calls delete -> 403
// after: admin grants 'chatflows:delete' to the user's role
// then the same call succeeds
await api.delete(`/api/v1/chatflows/${id}`)
Defensive patterns

Strategy: try-catch

Validate before calling

function canDeleteAnyChatflowType(user): boolean {
  if (!user) return false
  if ((user as any).isOrganizationAdmin) return true
  const perms: string[] = (user as any).permissions ?? []
  return perms.includes('chatflows:delete')
    || perms.includes('agentflows:delete')
    || perms.includes('assistants:delete')
}
if (!canDeleteAnyChatflowType(currentUser)) {
  // surface an 'insufficient permissions' UI instead of calling delete
}

Type guard

function isDeletionAuthorizedUser(u: unknown): boolean {
  if (typeof u !== 'object' || u === null) return false
  const user = u as any
  if (user.isOrganizationAdmin) return true
  return Array.isArray(user.permissions) && (
    user.permissions.includes('chatflows:delete') ||
    user.permissions.includes('agentflows:delete') ||
    user.permissions.includes('assistants:delete')
  )
}

Try / catch

try {
  await api.delete(`/api/v1/chatflows/${id}`)
} catch (err) {
  if (err?.response?.status === 403) {
    // show 'insufficient permissions — contact an org admin'
  } else {
    throw err
  }
}

Prevention

When it happens

Trigger: A non-admin user calls DELETE /api/v1/chatflows/:id. The code builds userPermittedTypes from req.user.permissions; if none of the delete scopes are present, the array stays empty and this throws.

Common situations: Viewer/read-only role attempting a delete; custom role missing the chatflows:delete permission; org admin flag (isOrganizationAdmin) is false due to a stale token even though the user should be admin; permission string typo in the role definition.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/34e212ae214c13c8. Report an issue: GitHub.