RocketChat/Rocket.Chat · error · Meteor.Error

error-id-param-not-provided

error-id-param-not-provided

Error message

The parameter "id" is required

What it means

Thrown by POST settings/:_id when the URL _id is not a string — i.e. it was not supplied at all. The route updates a single setting by id; the urlParams._id must be present in the path. Also note: ids matching /^Custom_Script_/ are blocked separately when disableCustomScripts is on.

Source

Thrown at apps/meteor/server/api/v1/settings.ts:406

	'settings/:_id',
	{
		authRequired: true,
		permissionsRequired: {
			POST: { permissions: ['edit-privileged-setting'], operation: 'hasAll' },
		},
		twoFactorRequired: true,
		body: settingsUpdateBodySchema,
		response: {
			200: settingByIdPostResponseSchema,
			400: validateBadRequestErrorResponse,
			401: validateUnauthorizedErrorResponse,
			403: validateForbiddenErrorResponse,
		},
	},
	async function action() {
		const { _id } = this.urlParams;
		if (typeof _id !== 'string') {
			throw new Meteor.Error('error-id-param-not-provided', 'The parameter "id" is required');
		}

		if (disableCustomScripts() && /^Custom_Script_/.test(_id)) {
			return API.v1.forbidden('Custom scripts are disabled');
		}

		const setting = await Settings.findOneNotHiddenById(_id);

		if (!setting) {
			return API.v1.failure();
		}

		const { bodyParams } = this;

		if (
			isSettingAction(setting) &&
			isSettingsUpdatePropsActions(bodyParams) &&
			bodyParams.execute &&

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Ensure the setting _id is in the URL path: /api/v1/settings/LDAP_Enable.
2. Read existing setting ids from settings GET before posting.
3. URL-encode the id (some ids contain dots/underscores but are otherwise safe).

Example fix

// before
await rest.post(`/api/v1/settings/${undefined}`, { value: true });

// after
if (typeof settingId !== 'string' || !settingId) throw new Error('setting id required');
await rest.post(`/api/v1/settings/${encodeURIComponent(settingId)}`, { value: true });

if (typeof settingId !== 'string' || settingId.trim() === '') {
  throw new Error('setting id is required in the URL path');
}
await rest.post(`/api/v1/settings/${encodeURIComponent(settingId)}`, { value });

function isSettingId(x: unknown): x is string {
  return typeof x === 'string' && x.trim().length > 0;
}

try {
  await rest.post(`/api/v1/settings/${settingId}`, body);
} catch (e) {
  if (isMeteorError(e, 'error-id-param-not-provided')) {
    notify('Setting id missing in URL.');
  } else throw e;
}

When it happens

Trigger: POST /api/v1/settings/<_id> where the <_id> path segment is missing so urlParams._id is undefined (not a string).

Common situations: Client building the URL with an undefined variable; calling the base /settings without an id; double slash collapsing the segment out.

Related errors

• error-name-param-not-provided
• The setting "${id}" is not readable.
• The setting "${setting.id}" is not readable.
• error-abac-not-enabled
• The "${name}" parameter must be a valid date.

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/0ca70372b73b256a. Report an issue: GitHub.