Mintplex-Labs/anything-llm · warning

Invalid invite id

Error message

Invalid invite id

What it means

The admin invite-deactivation API route (/v1/admin/invite/deactivate/:id) returns this 400 when Number(request.params.id) is NaN — i.e. the route parameter is not a numeric string. AnythingLLM invite ids are integer Prisma IDs, so letters, empty strings, '12abc', or floats like '1.5' (Number parses but later findUnique mismatches) fail validation before the DB is touched.

Source

Thrown at server/endpoints/api/admin/index.js:419

      schema: {
        "$ref": "#/definitions/InvalidAPIKey"
      }
    }
     #swagger.responses[401] = {
      description: "Instance is not in Multi-User mode. Method denied",
    }
    */
      try {
        if (!multiUserMode(response)) {
          response.sendStatus(401).end();
          return;
        }

        const { id } = request.params;
        const parsedId = Number(id);
        if (isNaN(parsedId)) {
          response
            .status(400)
            .json({ success: false, error: "Invalid invite id" });
          return;
        }

        const { success, error } = await Invite.deactivate(parsedId);
        if (!success) {
          response.status(404).json({
            success: false,
            error: "Invite not found or already disabled",
          });
          return;
        }

        response.status(200).json({ success, error });
      } catch (e) {
        console.error(e);
        response.sendStatus(500).end();
      }

View on GitHub (pinned to 3aec848f28)

Solutions

1. Pass the numeric invite id from the invite list API (GET admin invites), not the invite code
2. Client-side, guard Number(id) and Number.isInteger before making the call
3. Check your URL template for undefined interpolations

Example fix

// before
const url = `/api/v1/admin/invite/deactivate/${invite.code}`; // code is not numeric -> 400

// after
const url = `/api/v1/admin/invite/deactivate/${invite.id}`; // integer id from the invites list

function toInviteId(raw) {
  const n = Number(raw);
  if (!Number.isInteger(n) || n <= 0) throw new TypeError(`invite id must be an integer, got ${typeof raw}`);
  return n;
}

function isNumericInviteId(v) {
  return (typeof v === 'number' || typeof v === 'string') &&
    String(v).trim() !== '' &&
    Number.isInteger(Number(v));
}

When it happens

Trigger: Calling the route with /deactivate/abc, /deactivate/undefined, /deactivate/null, or a URL-encoded non-numeric id; templating bugs interpolating an undefined variable into the path.

Common situations: Scripts that pass the invite code string instead of the numeric id; string interpolation mistakes ('/deactivate/' + id with id undefined); copy-paste of the invite code into an admin script.

Related errors

• Invite not found or already disabled
• Empty entry
• Would exceed ${CHAR_LIMIT} char limit
• Filename is required
• Invalid filename format

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/218f1ecc63b5b511. Report an issue: GitHub.