RocketChat/Rocket.Chat · error · Error

error-abac-not-enabled

error-abac-not-enabled

Error message

error-abac-not-enabled

What it means

Thrown as Error('error-abac-not-enabled') in the POST abac/rooms/:rid/attributes action when settings.get('ABAC_Enabled') is falsy. This replace-all room-attributes endpoint refuses to run unless the ABAC feature is enabled, even though the license gate and permissions already passed.

Source

Thrown at apps/meteor/ee/server/api/abac/index.ts:69

		'abac/rooms/:rid/attributes',
		{
			authRequired: true,
			permissionsRequired: ['abac-management', 'manage-abac-admin-rooms'],
			body: POSTRoomAbacAttributesBodySchema,
			response: {
				200: GenericSuccessSchema,
				401: validateUnauthorizedErrorResponse,
				400: GenericErrorSchema,
				403: validateUnauthorizedErrorResponse,
			},
			license: ['abac'],
		},
		async function action() {
			const { rid } = this.urlParams;
			const { attributes } = this.bodyParams;

			if (!settings.get('ABAC_Enabled')) {
				throw new Error('error-abac-not-enabled');
			}

			// This is a replace-all operation
			// IF you need fine grained, use the other endpoints for removing, editing & adding single attributes
			await Abac.setRoomAbacAttributes(rid, attributes, getActorFromUser(this.user));
			return API.v1.success();
		},
	)
	.delete(
		'abac/rooms/:rid/attributes',
		{
			authRequired: true,
			permissionsRequired: ['abac-management', 'manage-abac-admin-rooms'],
			response: {
				200: GenericSuccessSchema,
				401: validateUnauthorizedErrorResponse,
				400: GenericErrorSchema,
				403: validateUnauthorizedErrorResponse,

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Enable ABAC via admin settings (ABAC_Enabled = true) before calling the endpoint.
2. Verify the setting persisted and was pushed to the client/cache.
3. Gate the caller UI so the room-attributes mutation is only offered when ABAC is enabled.

// Read ABAC_Enabled before offering the replace-all attributes action.
const abacEnabled = useSetting('ABAC_Enabled');
if (!abacEnabled) { /* hide/disable the bulk set attributes button */ }

try {
  await fetch('/api/v1/abac/rooms/:rid/attributes', { method: 'POST', body: ... });
} catch (e) {
  if (e?.error === 'error-abac-not-enabled') {
    // prompt admin to enable ABAC
  } else throw e;
}

When it happens

Trigger: Calling POST /api/v1/abac/rooms/:rid/attributes while ABAC_Enabled setting is false/off; ABAC licensed and permitted but the admin never toggled the setting on; setting reset during maintenance.

Common situations: Workspace has the ABAC license and role permissions but ABAC_Enabled is still off; integration/script that assumes ABAC is on.

Related errors

• error-abac-attribute-store-external
• The "${name}" parameter must be a valid date.
• LDAP_disabled
• error-room-is-abac-managed
• error-push-disabled

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/dcec340c339e1de7. Report an issue: GitHub.