{"record":{"id":"64e0f6b2ca67ddbc","repo":"RocketChat/Rocket.Chat","slug":"invalid-token-64e0f6","errorCode":"invalid-token","errorMessage":"invalid-token","messagePattern":"invalid-token","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/omnichannel/visitor.ts","lineNumber":112,"sourceCode":"\t\t\tif (!result) {\n\t\t\t\treturn API.v1.success({ visitor });\n\t\t\t}\n\n\t\t\treturn API.v1.success({ visitor: await VisitorsRaw.findOneEnabledById(visitor._id) });\n\t\t},\n\t},\n);\n\nAPI.v1.addRoute('livechat/visitor/:token', {\n\tasync get() {\n\t\tcheck(this.urlParams, {\n\t\t\ttoken: String,\n\t\t});\n\n\t\tconst visitor = await VisitorsRaw.getVisitorByToken(this.urlParams.token, {});\n\n\t\tif (!visitor) {\n\t\t\tthrow new Meteor.Error('invalid-token');\n\t\t}\n\n\t\treturn API.v1.success({ visitor });\n\t},\n\tasync delete() {\n\t\tcheck(this.urlParams, {\n\t\t\ttoken: String,\n\t\t});\n\n\t\tconst visitor = await VisitorsRaw.getVisitorByToken(this.urlParams.token, {});\n\t\tif (!visitor) {\n\t\t\tthrow new Meteor.Error('invalid-token');\n\t\t}\n\t\tconst extraQuery = await callbacks.run('livechat.applyRoomRestrictions', {}, { userId: this.userId });\n\t\tconst rooms = await LivechatRooms.findOpenByVisitorToken(\n\t\t\tthis.urlParams.token,\n\t\t\t{\n\t\t\t\tprojection: {","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/omnichannel/visitor.ts#L94-L130","documentation":"Thrown as Meteor.Error('invalid-token') in GET livechat/visitor/:token when VisitorsRaw.getVisitorByToken returns null. The route has no auth/permission gate, so the token is the sole lookup key; a miss means no visitor in the collection has that token.","triggerScenarios":"GET /api/v1/v1/livechat/visitor/<token> with a token that was never registered, was deleted, or was mistyped in the URL.","commonSituations":"Widget stored a token that was never persisted (registration failed silently); visitor was deleted via GDPR or admin tooling; URL copy/paste truncated the token.","solutions":["Ensure POST livechat/visitor completed successfully before querying by token.","Re-register the visitor to obtain a fresh token if the original was deleted.","Trim and verify the token length before issuing the GET."],"exampleFix":"null","handlingStrategy":"validation","validationCode":"if (!token?.trim()) throw new Error('token required');\nawait fetch(`/api/v1/v1/livechat/visitor/${encodeURIComponent(token)}`);","typeGuard":"function isNonEmptyToken(t: unknown): t is string {\n  return typeof t === 'string' && t.trim().length > 0;\n}","tryCatchPattern":"try { await fetch(url); } catch (e) { if (e.error === 'invalid-token') { /* re-register visitor, then retry */ } }","preventionTips":["Confirm registration completed before querying by token.","Handle invalid-token by re-registering the guest."],"tags":["omnichannel","visitor","token","not-found"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}