RocketChat/Rocket.Chat · warning · Meteor.Error

error-endpoint-disabled

error-endpoint-disabled

Error message

This endpoint is disabled

What it means

Thrown by the GET /api/v1/shield.svg endpoint when the API_Enable_Shields setting is falsy. The shields feature generates SVG status badges (for embedding in READMEs or wikis) and must be explicitly enabled by an administrator. The endpoint requires no authentication (authRequired: false) so this gate is the primary access control.

Source

Thrown at apps/meteor/server/api/v1/misc.ts:223

API.v1.get(
	'shield.svg',
	{
		authRequired: false,
		rateLimiterOptions: {
			numRequestsAllowed: 60,
			intervalTimeInMS: 60000,
		},
		query: isShieldSvgProps,
		response: {
			200: shieldSvgResponseSchema,
			400: validateBadRequestErrorResponse,
		},
	},
	async function action() {
		const { type, icon } = this.queryParams;
		let { channel, name } = this.queryParams;
		if (!settings.get('API_Enable_Shields')) {
			throw new Meteor.Error('error-endpoint-disabled', 'This endpoint is disabled', {
				route: '/api/v1/shield.svg',
			});
		}

		const types = settings.get<string>('API_Shield_Types');
		if (
			type &&
			types !== '*' &&
			!types
				.split(',')
				.map((t: string) => t.trim())
				.includes(type)
		) {
			throw new Meteor.Error('error-shield-disabled', 'This shield type is disabled', {
				route: '/api/v1/shield.svg',
			});
		}
		const hideIcon = icon === 'false';

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Enable shields: Administration > General > REST API > Enable Shields, or set API_Enable_Shields to true via the settings API.
  2. If shields were intentionally disabled, do not call this endpoint.
  3. Verify by reading the setting back: GET /api/v1/settings/API_Enable_Shields.

Example fix

// before: API_Enable_Shields is false
// after
PUT /api/v1/settings/API_Enable_Shields { "value": true }
Defensive patterns

Strategy: validation

Validate before calling

// Check if shields are enabled before requesting a badge
const res = await fetch(`${baseUrl}/api/v1/settings/API_Enable_Shields`, {
  headers: authHeaders
}).then(r => r.json());
if (!res.value) {
  throw new Error('Shields are disabled. Enable API_Enable_Shields.');
}

Try / catch

try {
  const svg = await fetchShieldBadge(type);
} catch (e) {
  if (e.error === 'error-endpoint-disabled') {
    console.warn('Shields endpoint is disabled — enable API_Enable_Shields setting.');
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: Requesting GET /api/v1/shield.svg?type=online when API_Enable_Shields is false or not set. The check fires before any badge rendering logic runs.

Common situations: Default installation where shields are disabled; admin disabled shields for security/privacy (exposing user counts or status externally); the setting was never configured.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/94055a6afcf396a1. Report an issue: GitHub.