{"record":{"id":"573bcd4d62911358","repo":"RocketChat/Rocket.Chat","slug":"invalid-integration-id-or-token-provided","errorCode":null,"errorMessage":"Invalid integration id or token provided.","messagePattern":"Invalid integration id or token provided\\.","errorType":"http","errorClass":"Error","httpStatus":401,"severity":"error","filePath":"apps/meteor/server/api/webhooks.ts","lineNumber":378,"sourceCode":"function integrationInfoRest(): { statusCode: number; body: { success: boolean } } {\n\tincomingLogger.info('Info integration');\n\treturn {\n\t\tstatusCode: 200,\n\t\tbody: {\n\t\t\tsuccess: true,\n\t\t},\n\t};\n}\n\nclass WebHookAPI extends APIClass<'/hooks'> {\n\toverride async authenticatedRoute(routeContext: APIActionContext): Promise<IUser | null> {\n\t\tconst { integrationId, token } = routeContext.urlParams;\n\t\tconst integration = await Integrations.findOneByIdAndToken<IIncomingIntegration>(integrationId, decodeURIComponent(token));\n\n\t\tif (!integration) {\n\t\t\tincomingLogger.info({ msg: 'Invalid integration id or token', integrationId, token });\n\n\t\t\tthrow new Error('Invalid integration id or token provided.');\n\t\t}\n\n\t\trouteContext.request.headers.set('x-auth-token', token);\n\n\t\tconst req = routeContext.request as Request & { integration?: IIncomingIntegration };\n\t\treq.integration = integration;\n\n\t\treturn Users.findOneById(req.integration.userId);\n\t}\n\n\toverride shouldAddRateLimitToRoute(options: { rateLimiterOptions?: RateLimiterOptions | boolean }): boolean {\n\t\tconst { rateLimiterOptions } = options;\n\t\treturn (\n\t\t\t(typeof rateLimiterOptions === 'object' || rateLimiterOptions === undefined) &&\n\t\t\t!process.env.TEST_MODE &&\n\t\t\tBoolean(defaultRateLimiterOptions.numRequestsAllowed && defaultRateLimiterOptions.intervalTimeInMS)\n\t\t);\n\t}","sourceCodeStart":360,"sourceCodeEnd":396,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/webhooks.ts#L360-L396","documentation":"Thrown by the WebHookAPI authenticatedRoute when no incoming integration matches the integrationId + token pair from the /hooks/:integrationId/:token URL. Integrations.findOneByIdAndToken returns null, meaning either the id does not exist or the token does not match the stored integration token. The token is URL-decoded before lookup.","triggerScenarios":"POST/GET to /api/v1/hooks/<integrationId>/<token> where integrationId is wrong/deleted, the token is wrong, or the token was URL-encoded incorrectly (e.g. double-encoded). The integration may also have been deleted or its token regenerated.","commonSituations":"Integration token regenerated in admin but the upstream webhook still has the old URL. Copy-paste of the webhook URL truncated. Token contains characters that were percent-encoded by the client and the server's decodeURIComponent does not reverse them as expected.","solutions":["Copy the exact webhook URL from the integration record in admin (Integrations > Incoming > Integration URL) and use it verbatim in the upstream service.","If the token was regenerated, update the upstream webhook URL with the new token.","Confirm the integration still exists and is not deleted; recreate if necessary.","Avoid re-encoding the token; pass it as-is in the path."],"exampleFix":"// before - upstream POSTs to a stale URL\nPOST /api/v1/hooks/abcOLD/oldToken123\n\n// after - copy current URL from the integration record\nPOST /api/v1/hooks/<currentId>/<currentToken>","handlingStrategy":"validation","validationCode":"const integration = await Integrations.findOneByIdAndToken(id, decodeURIComponent(token));\nif (!integration) throw new ClientError('not-found','integration id/token invalid or deleted');","typeGuard":"function isValidIntegrationRef(id, token) {\n  return typeof id === 'string' && id.length>0 && typeof token === 'string' && token.length>0;\n}","tryCatchPattern":"try { await POST(webhookUrl, body); }\ncatch (e) {\n  if (/Invalid integration id or token/.test(e?.message)) { refreshIntegrationUrl(); return; }\n  throw e;\n}","preventionTips":["Copy the webhook URL verbatim from the integration record.","After regenerating a token, update all upstream URLs immediately.","Avoid re-encoding the token in the path."],"tags":["api","integrations","webhooks","authentication","authorization"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}