{"record":{"id":"09f540a234aebd1e","repo":"n8n-io/n8n","slug":"this-account-is-managed-via-environment-variables","errorCode":null,"errorMessage":"This account is managed via environment variables and cannot be modified through the API","messagePattern":"This account is managed via environment variables and cannot be modified through the API","errorType":"exception","errorClass":"ForbiddenError","httpStatus":403,"severity":"warning","filePath":"packages/cli/src/controllers/me.controller.ts","lineNumber":61,"sourceCode":"\n\t/**\n\t * Update the logged-in user's properties, except password.\n\t */\n\t@Patch('/')\n\tasync updateCurrentUser(\n\t\treq: AuthenticatedRequest,\n\t\tres: Response,\n\t\t@Body payload: UserUpdateRequestDto,\n\t): Promise<PublicUser> {\n\t\tconst {\n\t\t\tid: userId,\n\t\t\temail: currentEmail,\n\t\t\tfirstName: currentFirstName,\n\t\t\tlastName: currentLastName,\n\t\t} = req.user;\n\n\t\tif (this.isUserManagedByEnv(req.user)) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t'This account is managed via environment variables and cannot be modified through the API',\n\t\t\t);\n\t\t}\n\n\t\tconst { currentPassword, ...payloadWithoutPassword } = payload;\n\t\tconst { email, firstName, lastName } = payload;\n\t\tconst isEmailBeingChanged = email !== currentEmail;\n\t\tconst isFirstNameChanged = firstName !== currentFirstName;\n\t\tconst isLastNameChanged = lastName !== currentLastName;\n\n\t\t// Check if the user is authenticated via SSO - they cannot change their profile info\n\t\tif (isEmailBeingChanged || isFirstNameChanged || isLastNameChanged) {\n\t\t\tconst ssoIdentity = await this.userService.findSsoIdentity(userId);\n\n\t\t\tif (ssoIdentity && this.isAuthIdentityActive(ssoIdentity)) {\n\t\t\t\tthis.logger.debug(\n\t\t\t\t\t`Request to update user failed because ${ssoIdentity.providerType} user may not change their profile information`,\n\t\t\t\t\t{","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/me.controller.ts#L43-L79","documentation":"A ForbiddenError (HTTP 403) from the PATCH /me (updateProfile) handler when isUserManagedByEnv(req.user) returns true. The owner account is bound to environment variables (ownerManagedByEnv with a matching ownerEmail), so its profile cannot be edited through the API — the source of truth is the env config. Returns 403 because the action is forbidden by configuration, not a bad request.","triggerScenarios":"PATCH /me changing email/firstName/lastName/password for the owner user when N8N_USER_MANAGEMENT_JWT_SECRET / owner env vars (N8N_OWNER_EMAIL etc.) are set and the requesting user's email matches the configured owner email.","commonSituations":"Self-hosted deployments that pin the owner via env vars for GitOps/immutability; an operator tries to rename the owner email through the UI; a Docker deploy with N8N_OWNER_EMAIL set.","solutions":["Update the owner profile by changing the relevant environment variables and restarting n8n.","If API edits are required, disable ownerManagedByEnv in the config and manage the owner via the DB/API.","Use a different (non-owner) account for profile edits via the API."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Detect env-managed owner before allowing profile edits.\nconst me = await api.get('/me');\nconst ownerManagedByEnv = me.flags?.ownerManagedByEnv ?? false;\nif (ownerManagedByEnv && me.role === 'global:owner') {\n  throw new Error('Owner profile is env-managed; edit via environment variables.');\n}","typeGuard":"function isEnvManagedOwner(u: { role: string; email: string }, cfg: { ownerManagedByEnv: boolean; ownerEmail: string }): boolean {\n  return cfg.ownerManagedByEnv\n    && u.role === 'global:owner'\n    && u.email.toLowerCase() === cfg.ownerEmail.toLowerCase();\n}","tryCatchPattern":"try {\n  await api.patch('/me', payload);\n} catch (e) {\n  if (e.response?.status === 403 && /environment variables/i.test(e.response.data.message)) {\n    notify('Edit this account via environment variables, not the API.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Disable the profile-edit form for the env-managed owner in the UI.","Document which env vars govern the owner account.","Prefer a non-owner service account for API-driven profile changes."],"tags":["me","profile","env-config","forbidden","owner"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}