What causes "Not allowed" in RocketChat/Rocket.Chat?

Print the exact value being passed and check it against db.rooms in a server shell (by _id and by name)

RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

getRoomIdByNameOrId failed to resolve its argument: neither Rooms.findOneById(rid) nor Rooms.findOneByName(rid) matched a document, so the method reports 'error-not-allowed'. The input is treated as an id first, then as a room name; no room exists under either interpretation.

Source

Thrown at apps/meteor/server/meteor-methods/rooms/getRoomIdByNameOrId.ts:31

		getRoomIdByNameOrId(rid: string): string;
	}
}

Meteor.methods<ServerMethods>({
	async getRoomIdByNameOrId(rid) {
		methodDeprecationLogger.method('getRoomIdByNameOrId', '9.0.0', '/v1/rooms.info');
		check(rid, String);

		if (!Meteor.userId()) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'getRoomIdByNameOrId',
			});
		}

		const room = (await Rooms.findOneById(rid)) || (await Rooms.findOneByName(rid));

		if (room == null) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
				method: 'getRoomIdByNameOrId',
			});
		}

		if (!(await canAccessRoomAsync(room, (await Meteor.userAsync()) ?? undefined))) {
			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
				method: 'getRoomIdByNameOrId',
			});
		}

		return room._id;
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

Print the exact value being passed and check it against db.rooms in a server shell (by _id and by name)
Trim the input and strip @/# decorations before sending
If the room was renamed, update the stored reference to the new name or stable _id
Migrate to GET /api/v1/rooms.info which accepts roomName and gives clearer failure semantics

Example fix

// before - raw user input may be deleted/renamed
const id = await Meteor.callAsync('getRoomIdByNameOrId', input);

// after - normalize input and fall back gracefully
const clean = input.trim().replace(/^[@#]/, '');
const id = await Meteor.callAsync('getRoomIdByNameOrId', clean);

Defensive patterns

Strategy: validation

Validate before calling

// normalize input and validate against known rooms before resolving
const clean = String(raw).trim().replace(/^[@#]/, '');
if (!clean) throw new Error('empty room reference');
const id = await Meteor.callAsync('getRoomIdByNameOrId', clean);

Try / catch

try {
  const id = await Meteor.callAsync('getRoomIdByNameOrId', clean);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-not-allowed') {
    // no room matched by _id or name - surface a 'room not found' UX
    notifyRoomNotFound(clean);
  }
}

Prevention

Store room _ids, not names, in long-lived configuration (names change)
Strip decorations and whitespace from user-entered room references
Verify references after workspace imports/renames

When it happens

Trigger: Passing a room id or name that was deleted, renamed, or mistyped; passing a channel name that includes the leading '@' or '#' decoration; passing an id belonging to a message, user, or subscription rather than a room.

Common situations: Integrations resolving human-entered channel names where the channel was renamed or removed; stale configuration referencing old room names; case-sensitivity or whitespace issues in the stored name.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/040bb9d2c60549c5. Report an issue: GitHub.