RocketChat/Rocket.Chat · error · AbacAttributeStoreExternalError

error-abac-attribute-store-external

error-abac-attribute-store-external

Error message

error-abac-attribute-store-external

What it means

Thrown as AbacAttributeStoreExternalError ('error-abac-attribute-store-external') by assertLocalAttributeStore() when Abac.isExternalAttributeStore() is true. Attribute-definition mutation endpoints (create/update/delete/get-in-use of abac/attributes) are only valid when the local store holds attribute definitions; an external PDP/store must be edited through its own system, so these endpoints refuse to mutate locally.

Source

Thrown at apps/meteor/ee/server/api/abac/index.ts:45

	GETAbacPdpHealthErrorResponseSchema,
} from './schemas';
import { API } from '../../../../server/api';
import type { ExtractRoutesFromAPI } from '../../../../server/api/ApiClass';
import { getPaginationItems } from '../../../../server/api/lib/getPaginationItems';
import { settings } from '../../../../server/settings';

const getActorFromUser = (user?: IUser | null): AbacActor | undefined =>
	user?._id
		? {
				_id: user._id,
				username: user.username,
				name: user.name,
			}
		: undefined;

const assertLocalAttributeStore = async (): Promise<void> => {
	if (await Abac.isExternalAttributeStore()) {
		throw new AbacAttributeStoreExternalError();
	}
};

const abacEndpoints = API.v1
	.post(
		'abac/rooms/:rid/attributes',
		{
			authRequired: true,
			permissionsRequired: ['abac-management', 'manage-abac-admin-rooms'],
			body: POSTRoomAbacAttributesBodySchema,
			response: {
				200: GenericSuccessSchema,
				401: validateUnauthorizedErrorResponse,
				400: GenericErrorSchema,
				403: validateUnauthorizedErrorResponse,
			},
			license: ['abac'],
		},

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Manage attribute definitions in the configured external attribute store/PDP instead of via these REST endpoints.
2. If local management is required, switch the ABAC attribute store back to local (admin ABAC settings).
3. Update the admin UI to disable local attribute editing controls when the store is external.

// Callers should check the store mode before issuing local attribute mutations.
GET /api/v1/abac/pdp/health or an admin settings fetch to determine if the store is external;
if external, disable local attribute CRUD controls.

try {
  await addAbacAttribute(...);
} catch (e) {
  if (e instanceof AbacAttributeStoreExternalError) {
    // tell user to manage attributes in the external store
  } else throw e;
}

When it happens

Trigger: Workspace is configured to use an external ABAC attribute store (PDP) and the client calls POST/PUT/DELETE/GET abac/attributes/:_id or abac/attributes/:key/is-in-use — assertLocalAttributeStore throws before touching the local collection.

Common situations: Admin switched ABAC to an external attribute store but the UI/API caller still issues local attribute-mutation calls; migration in progress; misconfigured store selection.

Related errors

• error-abac-not-enabled
• The "${name}" parameter must be a valid date.
• error-room-is-abac-managed
• Room not found
• error-action-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/f4f07a08d9a056bb. Report an issue: GitHub.