{"record":{"id":"89e4d6123d5213c3","repo":"RocketChat/Rocket.Chat","slug":"not-authorized-89e4d6","errorCode":"not_authorized","errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/integrations/incoming/addIncomingIntegration.ts","lineNumber":48,"sourceCode":"\t\t\tenabled: Boolean,\n\t\t\tusername: String,\n\t\t\tchannel: String,\n\t\t\talias: Match.Maybe(String),\n\t\t\temoji: Match.Maybe(String),\n\t\t\tscriptEnabled: Boolean,\n\t\t\tscriptEngine: Match.Maybe(String),\n\t\t\toverrideDestinationChannelEnabled: Match.Maybe(Boolean),\n\t\t\tscript: Match.Maybe(String),\n\t\t\tavatar: Match.Maybe(String),\n\t\t}),\n\t);\n\n\tif (\n\t\t!userId ||\n\t\t(!(await hasPermissionAsync(userId, 'manage-incoming-integrations')) &&\n\t\t\t!(await hasPermissionAsync(userId, 'manage-own-incoming-integrations')))\n\t) {\n\t\tthrow new Meteor.Error('not_authorized', 'Unauthorized', {\n\t\t\tmethod: 'addIncomingIntegration',\n\t\t});\n\t}\n\n\tif (!integration.channel || typeof integration.channel.valueOf() !== 'string') {\n\t\tthrow new Meteor.Error('error-invalid-channel', 'Invalid channel', {\n\t\t\tmethod: 'addIncomingIntegration',\n\t\t});\n\t}\n\n\tif (integration.channel.trim() === '') {\n\t\tthrow new Meteor.Error('error-invalid-channel', 'Invalid channel', {\n\t\t\tmethod: 'addIncomingIntegration',\n\t\t});\n\t}\n\n\tconst channels = integration.channel.split(',').map((channel) => channel.trim());\n","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/integrations/incoming/addIncomingIntegration.ts#L30-L66","documentation":"addIncomingIntegration rejects with not_authorized when there is no userId OR the user holds neither `manage-incoming-integrations` nor `manage-own-incoming-integrations`. Creating incoming webhooks requires at least one of these two permissions; the check runs after the integration object passes its Match validation.","triggerScenarios":"Calling `Meteor.call('addIncomingIntegration', integration)` while logged out, or as a user whose roles include neither integration permission — e.g. a regular member or a bot account without the integration role.","commonSituations":"Allowing non-admins to create their own webhooks without granting manage-own-incoming-integrations; custom roles built by copying 'user' instead of a privileged template; scripts assuming admin rights on a restricted token.","solutions":["Grant `manage-incoming-integrations` (full control) or `manage-own-incoming-integrations` (own webhooks only) to the caller's role","Verify authentication first — the same error covers a missing userId","For REST use POST /v1/integrations.create with a token whose role carries one of these permissions"],"exampleFix":"// before\nMeteor.call('addIncomingIntegration', integration, cb); // not_authorized\n\n// after\nconst canManage = usePermission('manage-incoming-integrations') || usePermission('manage-own-incoming-integrations');\nif (canManage) Meteor.call('addIncomingIntegration', integration, cb);","handlingStrategy":"validation","validationCode":"const canManage =\n  usePermission('manage-incoming-integrations') || usePermission('manage-own-incoming-integrations');\nif (Meteor.userId() && canManage) {\n  Meteor.call('addIncomingIntegration', integration, cb);\n}","typeGuard":null,"tryCatchPattern":"Meteor.call('addIncomingIntegration', integration, (err) => {\n  if (err && (err as Meteor.Error).error === 'not_authorized') {\n    // either not logged in or missing BOTH manage-incoming-integrations and\n    // manage-own-incoming-integrations — check session first, then permissions\n  }\n});","preventionTips":["Grant manage-own-incoming-integrations to roles that may create their own webhooks","Check both the session and one of the two permissions before showing the create form","For REST, give the token's role one of these permissions before calling /v1/integrations.create"],"tags":["rocket-chat","permissions","integrations","meteor-methods"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}