{"record":{"id":"615610e36d8de5e8","repo":"FlowiseAI/Flowise","slug":"error-chatflowscontroller-setwebhooksecret-work","errorCode":null,"errorMessage":"Error: chatflowsController.setWebhookSecret - workspace not found!","messagePattern":"Error: chatflowsController\\.setWebhookSecret - workspace not found!","errorType":"exception","errorClass":"InternalFlowiseError","httpStatus":401,"severity":"error","filePath":"packages/server/src/controllers/chatflows/index.ts","lineNumber":312,"sourceCode":"        }\n        const apiResponse = await chatflowsService.checkIfChatflowHasChanged(req.params.id, req.params.lastUpdatedDateTime, workspaceId)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n\nconst setWebhookSecret = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        if (!req.params.id) {\n            throw new InternalFlowiseError(\n                StatusCodes.PRECONDITION_FAILED,\n                `Error: chatflowsController.setWebhookSecret - id not provided!`\n            )\n        }\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {\n            throw new InternalFlowiseError(StatusCodes.UNAUTHORIZED, `Error: chatflowsController.setWebhookSecret - workspace not found!`)\n        }\n        const apiResponse = await chatflowsService.setWebhookSecret(req.params.id, workspaceId)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n\nconst clearWebhookSecret = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        if (!req.params.id) {\n            throw new InternalFlowiseError(\n                StatusCodes.PRECONDITION_FAILED,\n                `Error: chatflowsController.clearWebhookSecret - id not provided!`\n            )\n        }\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/server/src/controllers/chatflows/index.ts#L294-L330","documentation":"Thrown by setWebhookSecret when req.user?.activeWorkspaceId is falsy. Notably this guard returns UNAUTHORIZED (401), unlike most other workspace checks in the file which return NOT_FOUND (404) — an inconsistency to be aware of when mapping status codes to causes. The webhook secret is workspace-scoped, so the operation cannot proceed without a workspace.","triggerScenarios":"The request lacks an authenticated user context (no req.user) or the user has no activeWorkspaceId. Commonly seen when the endpoint is hit without a valid session/API key, or when auth middleware is skipped on the route.","commonSituations":"Missing/expired auth token, a reverse proxy stripping session cookies, an API key that does not resolve to a workspace, or a shared client reused after logout.","solutions":["Send a valid authenticated request (session cookie or API key) so req.user.activeWorkspaceId is populated.","Verify the user has an active workspace assigned; switch/create one if not.","Check the route is wired behind the same auth middleware used by other chatflow endpoints."],"exampleFix":"// before\nawait fetch(`/api/v1/chatflows/${id}/webhook-secret`, { method: 'POST' })\n// after\nawait fetch(`/api/v1/chatflows/${id}/webhook-secret`, {\n  method: 'POST',\n  headers: { Authorization: `Bearer ${apiKey}` }\n})","handlingStrategy":"validation","validationCode":"async function authedFetch(url: string, init: RequestInit) {\n  if (!token) throw new Error('no auth token - cannot resolve active workspace')\n  return fetch(url, { ...init, headers: { ...init.headers, Authorization: `Bearer ${token}` } })\n}","typeGuard":"const hasActiveWorkspace = (u: unknown): u is { activeWorkspaceId: string } =>\n  !!u && typeof (u as any).activeWorkspaceId === 'string'","tryCatchPattern":"try { await api.setWebhookSecret(id) } catch (e) { if (e.statusCode === 401) { await reAuth(); await api.setWebhookSecret(id) } else throw e }","preventionTips":["Send a valid session/API key on every workspace-scoped call.","Surface 401s to the user for re-login.","Verify auth middleware runs on the webhook routes."],"tags":["flowise","controller","validation","workspace","auth","unauthorized","webhook","typescript"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}