{"record":{"id":"6e82c29b7717a6ea","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-fields","errorCode":"error-invalid-fields","errorMessage":"Invalid fields parameter provided: \"${params.fields}\"","messagePattern":"Invalid fields parameter provided: \"(.+?)\"","errorType":"validation","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/lib/parseJsonQuery.ts","lineNumber":80,"sourceCode":"\tlet fields: Record<string, 0 | 1> | undefined;\n\tif (typeof params?.fields === 'string' && isUnsafeQueryParamsAllowed) {\n\t\ttry {\n\t\t\tapiDeprecationLogger.parameter(route, 'fields', '9.0.0', response, messageGenerator);\n\t\t\tfields = JSON.parse(params.fields) as Record<string, 0 | 1>;\n\t\t\tObject.entries(fields).forEach(([key, value]) => {\n\t\t\t\tif (value !== 1 && value !== 0) {\n\t\t\t\t\tthrow new Meteor.Error('error-invalid-sort-parameter', `Invalid fields parameter: ${key}`, {\n\t\t\t\t\t\thelperMethod: 'parseJsonQuery',\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tlogger.warn({\n\t\t\t\tmsg: 'Invalid fields parameter provided',\n\t\t\t\tfields: params.fields,\n\t\t\t\terr: e,\n\t\t\t});\n\t\t\tthrow new Meteor.Error('error-invalid-fields', `Invalid fields parameter provided: \\\"${params.fields}\\\"`, {\n\t\t\t\thelperMethod: 'parseJsonQuery',\n\t\t\t});\n\t\t}\n\t}\n\n\t// Verify the user's selected fields only contains ones which their role allows\n\tif (typeof fields === 'object') {\n\t\tlet nonSelectableFields = Object.keys(API.v1.defaultFieldsToExclude);\n\t\tif (isUsersRoute) {\n\t\t\tnonSelectableFields = nonSelectableFields.concat(\n\t\t\t\tObject.keys(canViewFullOtherUserInfo ? API.v1.limitedUserFieldsToExcludeIfIsPrivilegedUser : API.v1.limitedUserFieldsToExclude),\n\t\t\t);\n\t\t}\n\n\t\tObject.keys(fields).forEach((k) => {\n\t\t\tif (nonSelectableFields.includes(k) || nonSelectableFields.includes(k.split(API.v1.fieldSeparator)[0])) {\n\t\t\t\tfields && delete fields[k as keyof typeof fields];\n\t\t\t}","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/api/lib/parseJsonQuery.ts#L62-L98","documentation":"parseJsonQuery handles the deprecated fields projection param only when ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS=TRUE. The value is parsed with ejson and every entry must be exactly 0 or 1; a parse failure or any other value throws an inner error that is caught, logged, and rethrown as Meteor error-invalid-fields. If the env var is not TRUE the param is ignored entirely — so seeing this error proves the env var is set and the value is malformed.","triggerScenarios":"With ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS=TRUE, sending fields={\"name\":true}, fields={\"name\":\"1\"}, fields=name, or invalid JSON to any parseJsonQuery-backed endpoint.","commonSituations":"Migrating old SDK usage of the deprecated fields param after enabling the escape hatch; boolean projections copied from other APIs; forgetting that the param is deprecated and scheduled for removal (warned via deprecation headers) in favor of default projections.","solutions":["Use numeric 0/1 values: fields={\"name\":1,\"emails\":0}","Prefer removing the deprecated fields param and relying on the endpoint's default projection","URL-encode the JSON payload to avoid quote corruption"],"exampleFix":"// before\nGET /api/v1/users.list?fields={\"username\":true}\n\n// after\nGET /api/v1/users.list?fields={\"username\":1}","handlingStrategy":"validation","validationCode":"function buildFieldsParam(fields: Record<string, boolean | 0 | 1>): string | undefined {\n  const normalized = Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, v === true ? 1 : v === false ? 0 : v]));\n  if (Object.values(normalized).some((v) => v !== 0 && v !== 1)) throw new Error('fields values must be 0 or 1');\n  return JSON.stringify(normalized);\n}","typeGuard":"const isFieldsSpec = (v: unknown): v is Record<string, 0 | 1> =>\n  typeof v === 'object' && v !== null && !Array.isArray(v) &&\n  Object.values(v).every((x) => x === 0 || x === 1);","tryCatchPattern":"try {\n  await client.get('/api/v1/users.list', { params: { fields: JSON.stringify(fields) } });\n} catch (e: any) {\n  if (e?.response?.data?.errorType === 'error-invalid-fields') {\n    throw new ValidationError('fields param must be JSON with 0/1 values (and requires ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS=TRUE)');\n  }\n  throw e;\n}","preventionTips":["Migrate off the deprecated fields param — default projections need no param at all","Convert booleans to 0/1 before sending","Track the ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS env var in deployment notes; behavior differs when unset (param silently ignored)"],"tags":["rest-api","deprecated","fields-projection","env-var","validation","meteor-error"],"backgroundTag":"invalid-fields-parameter","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T10:36:37.832Z"}