RocketChat/Rocket.Chat · error · Error

not-allowed

Error message

not-allowed

What it means

Thrown by GET livechat/:rid/messages when the room exists but canAccessRoomAsync(room, this.user) returns false. So the caller is authenticated and holds view-l-room, but does not have access to this specific room (not a member, not an agent/manager with omnichannel scope, etc.).

Source

Thrown at apps/meteor/server/api/v1/omnichannel/visitors.ts:176

);

API.v1.addRoute(
	'livechat/:rid/messages',
	{ authRequired: true, permissionsRequired: ['view-l-room'], validateParams: isLivechatRidMessagesProps },
	{
		async get() {
			const { offset, count } = await getPaginationItems(this.queryParams);
			const { sort } = await this.parseJsonQuery();
			const { searchTerm } = this.queryParams;

			const room = await LivechatRooms.findOneById(this.urlParams.rid);

			if (!room) {
				throw new Error('invalid-room');
			}

			if (!(await canAccessRoomAsync(room, this.user))) {
				throw new Error('not-allowed');
			}

			const { cursor, totalCount } = Messages.findLivechatClosedMessages(this.urlParams.rid, searchTerm, {
				sort: sort || { ts: -1 },
				skip: offset,
				limit: count,
			});

			const [messages, total] = await Promise.all([cursor.toArray(), totalCount]);

			return API.v1.success({
				messages: await normalizeMessagesForUser(messages, this.userId),
				offset,
				count,
				total,
			});
		},
	},

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Grant the user membership or omnichannel-manager scope on the target room/department.
  2. Use an account with view-livechat-rooms or omnichannel-manager privileges for cross-room inspection.
  3. Confirm department routing includes the caller's scope.

Example fix

null
Defensive patterns

Strategy: validation

Validate before calling

const canAccess = await fetch(`/api/v1/v1/rooms.canAccess?rid=${rid}`, { headers }).then(r => r.json());
if (!canAccess.canAccess) throw new Error('insufficient scope');

Type guard

null

Try / catch

try { await fetch(url); } catch (e) { if (e.error === 'not-allowed') { /* escalate to omnichannel-manager account or request access */ } }

Prevention

When it happens

Trigger: An agent without omnichannel-manager scope querying a room they are not assigned to; a user who has view-l-room globally but is filtered out by room-level access checks; a monitor without the right department routing.

Common situations: Over-broad permission granted to a role but tighter per-room/department restrictions still apply; cross-department data access attempt in a multi-department setup.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/a507c984be965c72. Report an issue: GitHub.