{"record":{"id":"79b5f1e8ed02fd52","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-user-id","errorCode":"error-invalid-user-id","errorMessage":"Invalid user id","messagePattern":"Invalid user id","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/users.ts","lineNumber":1649,"sourceCode":"\t\t\t\t\t\ttokenExpires: { type: 'string' },\n\t\t\t\t\t\tsuccess: { type: 'boolean', enum: [true] },\n\t\t\t\t\t},\n\t\t\t\t\trequired: ['token', 'tokenExpires', 'success'],\n\t\t\t\t\tadditionalProperties: false,\n\t\t\t\t}),\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t},\n\t\t},\n\t\tasync function action() {\n\t\t\tconst xAuthToken = this.request.headers.get('x-auth-token') as string;\n\n\t\t\tif (!xAuthToken) {\n\t\t\t\tthrow new Meteor.Error('error-parameter-required', 'x-auth-token is required');\n\t\t\t}\n\t\t\tconst hashedToken = Accounts._hashLoginToken(xAuthToken);\n\n\t\t\tif (!(await Users.removeNonPATLoginTokensExcept(this.userId, hashedToken))) {\n\t\t\t\tthrow new Meteor.Error('error-invalid-user-id', 'Invalid user id');\n\t\t\t}\n\n\t\t\tconst me = (await Users.findOneById(this.userId, { projection: { 'services.resume.loginTokens': 1 } })) as Pick<IUser, 'services'>;\n\n\t\t\tvoid notifyOnUserChange({\n\t\t\t\tclientAction: 'updated',\n\t\t\t\tid: this.userId,\n\t\t\t\tdiff: { 'services.resume.loginTokens': me.services?.resume?.loginTokens },\n\t\t\t});\n\n\t\t\tconst token = me.services?.resume?.loginTokens?.find((token) => token.hashedToken === hashedToken);\n\n\t\t\tconst loginExp = settings.get<number>('Accounts_LoginExpiration');\n\n\t\t\tconst tokenExpires = (token && 'when' in token && new Date(token.when.getTime() + getLoginExpirationInMs(loginExp))) || undefined;\n\n\t\t\treturn API.v1.success({\n\t\t\t\ttoken: xAuthToken,","sourceCodeStart":1631,"sourceCodeEnd":1667,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/users.ts#L1631-L1667","documentation":"Thrown by the logout-other-clients endpoint after hashing the supplied x-auth-token, when Users.removeNonPATLoginTokensExcept(userId, hashedToken) returns falsy. The current token is not present in the user's resume tokens, so the 'keep this one, remove the rest' operation matched nothing.","triggerScenarios":"POST users.logoutOtherClients with an x-auth-token that is not in the user's services.resume.loginTokens (already revoked, or a PAT which is excluded).","commonSituations":"Token already logged out; token belongs to a different session/user; using a Personal Access Token in x-auth-token; stale client state.","solutions":["Re-authenticate and pass the current, valid login token in x-auth-token.","Do not pass a Personal Access Token here; use a resume login token instead.","If the token is valid but still fails, check the user's services.resume.loginTokens for the matching hashedToken."],"exampleFix":"null","handlingStrategy":"retry","validationCode":"// Re-authenticate if the stored token is stale\nconst valid = await GET('me');\nif (!valid) { await reAuthenticate(); }\nawait POST('users.logoutOtherClients', {}, { headers: { 'x-auth-token': token } });","typeGuard":"null","tryCatchPattern":"try {\n  await POST('users.logoutOtherClients', {}, { headers: { 'x-auth-token': token } });\n} catch (e) {\n  if (isMeteorError(e, 'error-invalid-user-id')) {\n    // token no longer matches a session; log in again and retry once\n    await reAuthenticate();\n  } else { throw e; }\n}","preventionTips":["Use resume login tokens (not PATs) for x-auth-token.","Re-authenticate when the session is known to be stale before calling."],"tags":["users","sessions","tokens","api","authentication"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}