RocketChat/Rocket.Chat · error · Error

Invalid asset

Error message

Invalid asset

What it means

Thrown by POST assets.setAsset when the uploaded file's resolved asset name (the refreshAllClients form field 'asset', falling back to the upload filename) is not one of the keys registered in RocketChatAssets.assets. The endpoint only accepts a fixed whitelist of theme asset names (logo, favicon, tile, etc.), so any other filename is rejected before storage.

Source

Thrown at apps/meteor/server/api/v1/assets.ts:53

	},
	async function action() {
		const asset = await getUploadFormData(
			{
				request: this.request,
			},
			{ field: 'asset', sizeLimit: settings.get('FileUpload_MaxFileSize') },
		);

		const { fileBuffer, fields, filename, mimetype } = asset;

		const { refreshAllClients, assetName: customName } = fields;

		const assetName = customName || filename;
		const assetsKeys = Object.keys(RocketChatAssets.assets);

		const isValidAsset = assetsKeys.includes(assetName);
		if (!isValidAsset) {
			throw new Error('Invalid asset');
		}

		const { key, value } = await RocketChatAssets.setAssetWithBuffer(fileBuffer, mimetype, assetName);

		const { modifiedCount } = await updateAuditedByUser({
			_id: this.userId,
			username: this.user.username ?? '',
			ip: this.requestIp ?? '',
			useragent: this.request.headers.get('user-agent') ?? '',
		})(Settings.updateValueById, key, value);

		if (modifiedCount) {
			void notifyOnSettingChangedById(key);
		}

		if (refreshAllClients) {
			await refreshClients(this.userId);
		}

View on GitHub (pinned to b2c16d5842)

Solutions

1. Send the canonical asset key in the 'asset' multipart field (e.g. 'logo', 'favicon') rather than relying on the filename
2. List valid keys first: they are the keys of the assets registry (client-side asset manager or server settings) before uploading
3. Match the exact casing and suffix conventions (e.g. logo_1024 for variants)
4. Retry the upload with content-type multipart/form-data and the file under the 'asset' file field per the API docs

Example fix

// before (curl -F file=@My_Logo_Design_Final.png)
// after
curl -F "file=@logo.png;filename=logo" -F asset=logo ... /api/v1/assets.setAsset

const VALID_ASSETS = ['logo', 'logo_1024', 'favicon', 'tile', 'tile_144', 'tile_180', 'tile_192'];
const assetName = form.get('asset') || file.name;
if (!VALID_ASSETS.includes(assetName)) throw new Error(`Unknown asset: ${assetName}`);

const isValidAssetName = (name: string): boolean =>
  Object.keys(ASSET_REGISTRY).includes(name);

try { await POST('/api/v1/assets.setAsset', form); } catch (e) {
  if (e.message === 'Invalid asset') { /* show allowed asset names */ }
}

When it happens

Trigger: POST /api/v1/assets.setAsset (multipart) where the 'asset' form field or the file's filename is e.g. 'my-company-logo.png' instead of a registered name like 'logo' or 'logo_1024.png', or a typo such as 'favion'.

Common situations: Automation scripts upload with the original design file name; CI renames assets before upload; admin uploads a new custom asset type not in the whitelist; trailing spaces or case differences in the asset name.

Related errors

• Param "${params.name?.key}" is required
• Param "${params.members.key}" must be an array if provided
• Param "${params.customFields.key}" must be an object if prov
• Param ${params.teams.key} must be an array
• Type not supported

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/054597d2ff0c36dc. Report an issue: GitHub.