Mintplex-Labs/anything-llm · warning

Unauthorized

Error message

Unauthorized

What it means

GET /v1/admin/users (server/endpoints/api/admin/index.js:41) returns HTTP 401 via response.sendStatus(401).end() at line 73 when `!multiUserMode(response)` is true. multiUserMode reads response.locals.multiUserMode, which was set by the validApiKey middleware from SystemSettings.isMultiUserMode(). This is an intentional denial: the admin user-management API is disabled on single-user instances.

Source

Thrown at server/endpoints/api/admin/index.js:73

                }
             ]
            }
          }
        }
      }
    }
    #swagger.responses[403] = {
      schema: {
        "$ref": "#/definitions/InvalidAPIKey"
      }
    }
     #swagger.responses[401] = {
      description: "Instance is not in Multi-User mode. Method denied",
    }
    */
    try {
      if (!multiUserMode(response)) {
        response.sendStatus(401).end();
        return;
      }

      const users = await User.where();
      response.status(200).json({ users });
    } catch (e) {
      console.error(e);
      response.sendStatus(500).end();
    }
  });

  app.post("/v1/admin/users/new", [validApiKey], async (request, response) => {
    /*
    #swagger.tags = ['Admin']
    #swagger.description = 'Create a new user with username and password. Methods are disabled until multi user mode is enabled via the UI.'
    #swagger.requestBody = {
        description: 'Key pair object that will define the new user to add to the system.',
        required: true,

View on GitHub (pinned to 526360e320)

Solutions

1. Enable multi-user mode in the UI (Admin > Multi-User Mode) before calling any /v1/admin/users endpoint.
2. If automating, first call GET /v1/admin/is-multi-user-mode to confirm the flag, then enable it via the UI or DB before retrying.
3. For single-user workflows, use the workspace/document APIs instead of the admin user APIs.
4. Verify SystemSettings.isMultiUserMode() returns true in the database (system_settings row with label 'multi_user_mode' set to 'true').

// client-side gate
const r = await fetch('/api/v1/admin/is-multi-user-mode', { headers: authHeaders() });
const { isMultiUser } = await r.json();
if (!isMultiUser) throw new Error('Enable multi-user mode before calling /v1/admin/users');

if (!multiUserMode(response)) {
  // 401 by design — surface a clear message to the operator
  return response.status(401).json({ error:'Enable multi-user mode to use this endpoint' });
}

When it happens

Trigger: Calling GET /v1/admin/users with a valid API key on an instance where multi-user mode has not been enabled via the UI; the SystemSettings multi_user_mode flag being false; an instance provisioned as single-user that the operator tried to drive via the admin REST API.

Common situations: Default Docker/standalone install (single-user by default) being automated through /v1/admin/* endpoints before the operator enabled multi-user mode; a freshly restored backup where the multi_user_mode system setting was reset; testing locally without first running the multi-user setup wizard.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Internal Server Error
• Not Found
• Bad Request
• Internal Server Error
• Internal Server Error

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/eccda3d0b31a29ec. Report an issue: GitHub.