{"record":{"id":"94055a6afcf396a1","repo":"RocketChat/Rocket.Chat","slug":"error-endpoint-disabled-94055a","errorCode":"error-endpoint-disabled","errorMessage":"This endpoint is disabled","messagePattern":"This endpoint is disabled","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"warning","filePath":"apps/meteor/server/api/v1/misc.ts","lineNumber":223,"sourceCode":"API.v1.get(\n\t'shield.svg',\n\t{\n\t\tauthRequired: false,\n\t\trateLimiterOptions: {\n\t\t\tnumRequestsAllowed: 60,\n\t\t\tintervalTimeInMS: 60000,\n\t\t},\n\t\tquery: isShieldSvgProps,\n\t\tresponse: {\n\t\t\t200: shieldSvgResponseSchema,\n\t\t\t400: validateBadRequestErrorResponse,\n\t\t},\n\t},\n\tasync function action() {\n\t\tconst { type, icon } = this.queryParams;\n\t\tlet { channel, name } = this.queryParams;\n\t\tif (!settings.get('API_Enable_Shields')) {\n\t\t\tthrow new Meteor.Error('error-endpoint-disabled', 'This endpoint is disabled', {\n\t\t\t\troute: '/api/v1/shield.svg',\n\t\t\t});\n\t\t}\n\n\t\tconst types = settings.get<string>('API_Shield_Types');\n\t\tif (\n\t\t\ttype &&\n\t\t\ttypes !== '*' &&\n\t\t\t!types\n\t\t\t\t.split(',')\n\t\t\t\t.map((t: string) => t.trim())\n\t\t\t\t.includes(type)\n\t\t) {\n\t\t\tthrow new Meteor.Error('error-shield-disabled', 'This shield type is disabled', {\n\t\t\t\troute: '/api/v1/shield.svg',\n\t\t\t});\n\t\t}\n\t\tconst hideIcon = icon === 'false';","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/misc.ts#L205-L241","documentation":"Thrown by the GET /api/v1/shield.svg endpoint when the API_Enable_Shields setting is falsy. The shields feature generates SVG status badges (for embedding in READMEs or wikis) and must be explicitly enabled by an administrator. The endpoint requires no authentication (authRequired: false) so this gate is the primary access control.","triggerScenarios":"Requesting GET /api/v1/shield.svg?type=online when API_Enable_Shields is false or not set. The check fires before any badge rendering logic runs.","commonSituations":"Default installation where shields are disabled; admin disabled shields for security/privacy (exposing user counts or status externally); the setting was never configured.","solutions":["Enable shields: Administration > General > REST API > Enable Shields, or set API_Enable_Shields to true via the settings API.","If shields were intentionally disabled, do not call this endpoint.","Verify by reading the setting back: GET /api/v1/settings/API_Enable_Shields."],"exampleFix":"// before: API_Enable_Shields is false\n// after\nPUT /api/v1/settings/API_Enable_Shields { \"value\": true }","handlingStrategy":"validation","validationCode":"// Check if shields are enabled before requesting a badge\nconst res = await fetch(`${baseUrl}/api/v1/settings/API_Enable_Shields`, {\n  headers: authHeaders\n}).then(r => r.json());\nif (!res.value) {\n  throw new Error('Shields are disabled. Enable API_Enable_Shields.');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const svg = await fetchShieldBadge(type);\n} catch (e) {\n  if (e.error === 'error-endpoint-disabled') {\n    console.warn('Shields endpoint is disabled — enable API_Enable_Shields setting.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Check the API_Enable_Shields setting before embedding shield badges in external content.","Provide a fallback image or text in case the shields endpoint is disabled."],"tags":["api","shields","configuration","settings"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}