{"record":{"id":"774eed370c978cbb","repo":"RocketChat/Rocket.Chat","slug":"error-shield-disabled","errorCode":"error-shield-disabled","errorMessage":"This shield type is disabled","messagePattern":"This shield type is disabled","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"warning","filePath":"apps/meteor/server/api/v1/misc.ts","lineNumber":237,"sourceCode":"\tasync function action() {\n\t\tconst { type, icon } = this.queryParams;\n\t\tlet { channel, name } = this.queryParams;\n\t\tif (!settings.get('API_Enable_Shields')) {\n\t\t\tthrow new Meteor.Error('error-endpoint-disabled', 'This endpoint is disabled', {\n\t\t\t\troute: '/api/v1/shield.svg',\n\t\t\t});\n\t\t}\n\n\t\tconst types = settings.get<string>('API_Shield_Types');\n\t\tif (\n\t\t\ttype &&\n\t\t\ttypes !== '*' &&\n\t\t\t!types\n\t\t\t\t.split(',')\n\t\t\t\t.map((t: string) => t.trim())\n\t\t\t\t.includes(type)\n\t\t) {\n\t\t\tthrow new Meteor.Error('error-shield-disabled', 'This shield type is disabled', {\n\t\t\t\troute: '/api/v1/shield.svg',\n\t\t\t});\n\t\t}\n\t\tconst hideIcon = icon === 'false';\n\t\tif (hideIcon && !name?.trim()) {\n\t\t\treturn API.v1.failure('Name cannot be empty when icon is hidden');\n\t\t}\n\n\t\tlet text;\n\t\tlet backgroundColor = '#4c1';\n\t\tswitch (type) {\n\t\t\tcase 'online':\n\t\t\t\tif (Date.now() - onlineCacheDate > cacheInvalid) {\n\t\t\t\t\tonlineCache = await Users.countUsersNotOffline();\n\t\t\t\t\tonlineCacheDate = Date.now();\n\t\t\t\t}\n\n\t\t\t\ttext = `${onlineCache} ${i18n.t('Online')}`;","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/misc.ts#L219-L255","documentation":"Thrown by GET /api/v1/shield.svg when the requested type query parameter is not included in the API_Shield_Types setting (and that setting is not '*'). The allowed types are a comma-separated whitelist — if 'user' or 'channel' is excluded, requesting it produces this error.","triggerScenarios":"Calling GET /api/v1/shield.svg?type=user when API_Shield_Types is set to 'online,channel' (not including 'user' or '*'). Or requesting any type not in the configured list.","commonSituations":"Admin restricted shield types for privacy (e.g., disabled 'user' type to prevent exposing individual user statuses); typo in the type parameter; the setting was changed and the client is using an outdated type.","solutions":["Add the desired type to the API_Shield_Types setting (e.g., 'online,channel,user'), or set it to '*' for all types.","Use a shield type that is in the current allowed list.","Check the current setting via GET /api/v1/settings/API_Shield_Types before requesting a specific type."],"exampleFix":"// before: API_Shield_Types = \"online,channel\"\n// request shield.svg?type=user -> error\n// after: update the setting\nPUT /api/v1/settings/API_Shield_Types { \"value\": \"online,channel,user\" }","handlingStrategy":"validation","validationCode":"// Fetch allowed shield types and validate the requested type before calling\nconst res = await fetch(`${baseUrl}/api/v1/settings/API_Shield_Types`, {\n  headers: authHeaders\n}).then(r => r.json());\n\nconst allowedTypes = res.value === '*' ? ['online', 'channel', 'user'] : res.value.split(',').map(t => t.trim());\nif (!allowedTypes.includes(requestedType)) {\n  throw new Error(`Shield type '${requestedType}' is not allowed. Allowed: ${allowedTypes.join(', ')}`);\n}","typeGuard":"function isAllowedShieldType(type: string, allowedTypes: string | string[]): boolean {\n  if (allowedTypes === '*') return true;\n  const list = typeof allowedTypes === 'string' ? allowedTypes.split(',').map(t => t.trim()) : allowedTypes;\n  return list.includes(type);\n}","tryCatchPattern":"try {\n  const svg = await fetchShieldBadge(type);\n} catch (e) {\n  if (e.error === 'error-shield-disabled') {\n    console.warn(`Shield type '${type}' is disabled. Check API_Shield_Types setting.`);\n    return;\n  }\n  throw e;\n}","preventionTips":["Read the API_Shield_Types setting before requesting a specific shield type.","Default to 'online' type which is the most commonly allowed type."],"tags":["api","shields","configuration","settings"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}