TryGhost/Ghost · error · MethodNotAllowedError

You cannot destroy comments.

Error message

You cannot destroy comments.

What it means

A MethodNotAllowedError thrown unconditionally by `destroy()` in the comments controller. Ghost's public comments API does not permit deleting comments through this endpoint — the method body simply throws regardless of input. It is a hard contract, not a conditional check, so no payload will succeed.

Source

Thrown at ghost/core/core/server/services/comments/comments-controller.js:329

                data.html,
                frame.options
            );
        } else {
            result = await this.service.commentOnPost(
                data.post_id,
                frame.options.context.member.id,
                data.html,
                frame.options
            );
        }

        this.setCacheInvalidationHeaders(result, frame);

        return result;
    }

    async destroy() {
        throw new MethodNotAllowedError({
            message: tpl(messages.cannotDestroyComments)
        });
    }

    async count(frame) {
        if (!frame?.options?.ids) {
            return await this.stats.getAllCounts();
        }

        const ids = frame?.options?.ids.split(',');

        return await this.stats.getCountsByPost(ids);
    }

    /**
     * @param {Frame} frame
     */
    async like(frame) {

View on GitHub (pinned to 47d8b0e2ad)

Solutions

1. Do not call DELETE on comments — this operation is intentionally unsupported in the public API.
2. If moderation removal is required, use the admin moderation tools or mark the comment as reported/hidden per the supported flows.
3. Remove or disable the delete UI affordance for comments in the client.
4. Handle `405 Method Not Allowed` gracefully and inform the user comments cannot be deleted.

Example fix

// before
await api.comments.destroy({id}); // -> 405

// after: use the supported moderation action instead (e.g. report)
await api.comments.report({id, reason});
// or hide the delete button in the UI

// There is no payload that succeeds; guard the call site
function assertCommentsDestroyAllowed() {
  throw new Error('DELETE is not supported on comments; remove the call');
}

const supportsCommentDestroy = false; // hard contract — never call destroy()

try {
  await api.comments.destroy({id});
} catch (err) {
  if (err.type === 'MethodNotAllowedError') informUser('Comments cannot be deleted');
  else throw err;
}

When it happens

Trigger: Sending a `DELETE` request to the public comments resource (e.g. `DELETE /api/member/comments/{id}` or the equivalent admin/comments route). Any such request hits this controller method and is rejected.

Common situations: A client SDK defaults to DELETE for resource removal and a developer assumed comments support it; a frontend wired a delete button to the comments endpoint; confusion between the public comments API (no delete) and a moderation/admin workflow.

Related errors

• Failed to fetch comments
• Failed to add comment
• Failed to edit comment
• Failed to read comment
• The body of a comment cannot be empty

AI-assisted analysis of TryGhost/Ghost@47d8b0e2ad (2026-08-13). Data as JSON: /api/errors/aa70f1932931071a. Report an issue: GitHub.