RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-integration

error-invalid-integration

Error message

Invalid integration

What it means

After the permission check, clearIntegrationHistory could not resolve the integration: with the full permission no document matched the _id, and with the own-permission no document matched both _id and _createdBy._id = userId. The throw happens before any history is removed.

Source

Thrown at apps/meteor/server/lib/integrations/functions/clearIntegrationHistory.ts:24

import notifications from '../../notifications/core/lib/Notifications';
import { triggerHandler } from '../lib/triggerHandler';

export const clearIntegrationHistoryMethod = async (userId: string, integrationId: string): Promise<void> => {
	let integration: IIntegration | null = null;

	if (await hasPermissionAsync(userId, 'manage-outgoing-integrations')) {
		integration = await Integrations.findOneById<IIntegration>(integrationId);
	} else if (await hasPermissionAsync(userId, 'manage-own-outgoing-integrations')) {
		integration = await Integrations.findOne<IIntegration>({
			'_id': integrationId,
			'_createdBy._id': userId,
		});
	} else {
		throw new Meteor.Error('not_authorized', 'Unauthorized', { method: 'clearIntegrationHistory' });
	}

	if (!integration) {
		throw new Meteor.Error('error-invalid-integration', 'Invalid integration', { method: 'clearIntegrationHistory' });
	}

	await IntegrationHistory.removeByIntegrationId(integrationId);

	notifications.streamIntegrationHistory.emit(integrationId, { type: 'removed', id: integrationId });
};

export const replayOutgoingIntegrationMethod = async (
	userId: string,
	{ integrationId, historyId }: { integrationId: string; historyId: string },
): Promise<void> => {
	let integration: IOutgoingIntegration | null = null;

	if (await hasPermissionAsync(userId, 'manage-outgoing-integrations')) {
		integration = await Integrations.findOneById<IOutgoingIntegration>(integrationId);
	} else if (await hasPermissionAsync(userId, 'manage-own-outgoing-integrations')) {
		const found = await Integrations.findOne<IOutgoingIntegration>({
			'_id': integrationId,

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Verify the integration id in Administration > Integrations and re-select it fresh
  2. With only the 'own' permission, use an integration you created — or request manage-outgoing-integrations
Defensive patterns

Strategy: validation

Validate before calling

const integration = (await hasPermissionAsync(userId, 'manage-outgoing-integrations'))
  ? await Integrations.findOneById(integrationId)
  : await Integrations.findOne({ '_id': integrationId, '_createdBy._id': userId });
if (!integration) {
  // integration missing or not owned: don't invoke the method
}

Prevention

When it happens

Trigger: Passing a nonexistent integrationId, or an integration that exists but was created by someone else while the caller only holds manage-own-outgoing-integrations.

Common situations: Stale integration list in the UI after the integration was deleted; integration ids copied between environments; integration ownership changed.

Related errors


AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/e17557fcbe5286d1. Report an issue: GitHub.