{"record":{"id":"00e33a5caf2dcccc","repo":"n8n-io/n8n","slug":"security-settings-are-managed-via-environment-vari","errorCode":null,"errorMessage":"Security settings are managed via environment variables and cannot be modified through the API","messagePattern":"Security settings are managed via environment variables and cannot be modified through the API","errorType":"exception","errorClass":"ForbiddenError","httpStatus":403,"severity":"error","filePath":"packages/cli/src/controllers/security-settings.controller.ts","lineNumber":47,"sourceCode":"\t\t]);\n\n\t\treturn {\n\t\t\t...settings,\n\t\t\tmanagedByEnv: this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv,\n\t\t\t...(workflowReviews !== undefined ? { workflowReviews } : {}),\n\t\t};\n\t}\n\n\t@Licensed('feat:personalSpacePolicy')\n\t@GlobalScope('securitySettings:manage')\n\t@Post('/')\n\tasync updateSecuritySettings(\n\t\treq: AuthenticatedRequest,\n\t\t_res: Response,\n\t\t@Body dto: UpdateSecuritySettingsDto,\n\t) {\n\t\tif (this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t'Security settings are managed via environment variables and cannot be modified through the API',\n\t\t\t);\n\t\t}\n\n\t\tif (dto.workflowReviews !== undefined) {\n\t\t\tthis.assertWorkflowReviewsAvailable();\n\t\t}\n\n\t\tconst updatedSettings: Partial<UpdateSecuritySettingsDto> =\n\t\t\tawait this.securitySettingsService.updateSecuritySettings(\n\t\t\t\t{\n\t\t\t\t\tpersonalSpacePublishing: dto.personalSpacePublishing,\n\t\t\t\t\tpersonalSpaceSharing: dto.personalSpaceSharing,\n\t\t\t\t\tredactionEnforcement: dto.redactionEnforcement,\n\t\t\t\t},\n\t\t\t\treq.user,\n\t\t\t);\n","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/security-settings.controller.ts#L29-L65","documentation":"The instance is configured so security policy is controlled by environment variables (instanceSettingsLoaderConfig.securityPolicyManagedByEnv === true). Under that mode, writes to security settings via the API are blocked with 403 ForbiddenError, because the source of truth is the environment, not the database.","triggerScenarios":"POST /security-settings (updateSecuritySettings) when the instance was started with securityPolicyManagedByEnv enabled.","commonSituations":"Hardened/enterprise deployment where policy is pinned via env to prevent runtime drift; GitOps/env-managed config; admin tries the UI/API toggle and it is intentionally disabled.","solutions":["Change the relevant security env vars and restart the instance instead of using the API.","If API management is genuinely required, disable securityPolicyManagedByEnv in the configuration and restart."],"exampleFix":"// before: trying to PATCH security settings via API while env-managed -> 403\n// after: set policy via env and restart\n// N8N_SECURITY_PERSONAL_SPACE_PUBLISHING=...\n// then restart n8n; do not call POST /security-settings","handlingStrategy":"validation","validationCode":"// Determine if security settings are env-managed before attempting writes.\nfunction isSecurityPolicyEnvManaged(state) { return Boolean(state?.securityPolicyManagedByEnv); }","typeGuard":null,"tryCatchPattern":"try {\n  await api.post('/security-settings', dto);\n} catch (e) {\n  if (e.status === 403 && /managed via environment variables/.test(e.message)) {\n    // stop calling the API; update env vars and restart instead\n  } else { throw e; }\n}","preventionTips":["Reflect env-managed mode in the UI by disabling the controls.","Keep security policy in version-controlled env config."],"tags":["security","config","env","license"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}