Mintplex-Labs/anything-llm · error

Invalid request

Error message

Invalid request

What it means

Mode guard in the isMultiUserSetup middleware: SystemSettings.isMultiUserMode() returned false, so the instance runs in single-user mode and the multi-user-only public route is refused with 403 to prevent unauthenticated access.

Source

Thrown at server/utils/middleware/multiUserProtected.js:91

      return;
    }

    const user =
      response.locals?.user ?? (await userFromSession(request, response));
    if (allowedRoles.includes(user?.role)) {
      next();
      return;
    }
    return response.sendStatus(401).end();
  };
}

// Middleware check on a public route if the instance is in a valid
// multi-user set up.
async function isMultiUserSetup(_request, response, next) {
  const multiUserMode = await SystemSettings.isMultiUserMode();
  if (!multiUserMode) {
    response.status(403).json({
      error: "Invalid request",
    });
    return;
  }

  next();
  return;
}

module.exports = {
  ROLES,
  isSingleUserMode,
  strictMultiUserRoleValid,
  flexUserRoleValid,
  isMultiUserSetup,
};

View on GitHub (pinned to 3aec848f28)

Solutions

1. Enable Multi-User mode in the AnythingLLM security settings before calling this route.
2. This middleware (isMultiUserSetup) blocks the route when the instance is not in multi-user mode; no other action is possible.

When it happens

Trigger: Multi-user protected route received an invalid request. Triggered when the multiUserProtected middleware cannot resolve a valid user/session for the request (multiUserProtected.js:91).

Common situations: See trigger scenarios.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/1d6e11d2dd57fe0f. Report an issue: GitHub.