{"record":{"id":"a015793c1859bb4f","repo":"langgenius/dify","slug":"not-allowed-create-workspace","errorCode":"not_allowed_create_workspace","errorMessage":"Workspace not found, please contact system admin to invite you to join in a workspace.","messagePattern":"Workspace not found, please contact system admin to invite you to join in a workspace\\.","errorType":"error_code","errorClass":"NotAllowedCreateWorkspace","httpStatus":400,"severity":"error","filePath":"api/controllers/console/auth/login.py","lineNumber":321,"sourceCode":"            raise EmailCodeError()\n\n        AccountService.revoke_email_code_login_token(req_data.token)\n        try:\n            account = _get_account_with_case_fallback(original_email)\n        except Unauthorized as exc:\n            _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_BANNED)\n            raise AccountBannedError() from exc\n        except AccountRegisterError:\n            _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_IN_FREEZE)\n            raise AccountInFreezeError()\n        if account:\n            tenants = TenantService.get_join_tenants(account, session=db.session())\n            if not tenants:\n                workspaces = FeatureService.get_license().workspaces\n                if not workspaces.is_available():\n                    raise WorkspacesLimitExceeded()\n                if not FeatureService.is_workspace_creation_allowed():\n                    raise NotAllowedCreateWorkspace()\n                else:\n                    TenantService.create_owner_tenant(account, session=db.session())\n\n        if account is None:\n            try:\n                account = AccountService.create_account_and_tenant(\n                    email=user_email,\n                    name=user_email,\n                    interface_language=get_valid_language(language),\n                    timezone=req_data.timezone,\n                    session=db.session(),\n                )\n            except WorkSpaceNotAllowedCreateError:\n                raise NotAllowedCreateWorkspace()\n            except SeatsLimitExceededError:\n                raise SeatsLimitExceeded()\n            except AccountRegisterError:\n                _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_IN_FREEZE)","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/login.py#L303-L339","documentation":"Raised by POST /console/api/email-code-login/validity (HTTP 400, code not_allowed_create_workspace) for an existing account with no tenants where the license has workspace slots available but FeatureService.is_workspace_creation_allowed() is false. The system will not auto-create a tenant for the account, so the user cannot proceed.","triggerScenarios":"POST /console/api/email-code-login/validity for an existing, tenant-less account, where workspaces.is_available() is true but is_workspace_creation_allowed() returns false. The controller raises NotAllowedCreateWorkspace instead of creating an owner tenant.","commonSituations":"Admin disabled workspace creation (single-workspace policy); SSO-managed deployment where tenants are pre-provisioned; account removed from its workspace and the deployment forbids self-service workspace creation; misconfigured feature flag.","solutions":["Have an admin invite the user to an existing workspace.","If appropriate, enable workspace creation via the feature flag backing FeatureService.is_workspace_creation_allowed().","Verify the account truly should be in a workspace; re-add them through the admin console.","Check FeatureService configuration source (license/config) for the creation flag."],"exampleFix":"# before\nif not FeatureService.is_workspace_creation_allowed():\n    raise NotAllowedCreateWorkspace()\n# after - keep the guard but expose a clearer next step\nif not FeatureService.is_workspace_creation_allowed():\n    raise NotAllowedCreateWorkspace(description='Self-service workspace creation is disabled. Ask your admin to invite you.')","handlingStrategy":"validation","validationCode":"from services.feature_service import FeatureService\n\ndef can_self_create_workspace_for_existing() -> bool:\n    return FeatureService.is_workspace_creation_allowed()","typeGuard":"null","tryCatchPattern":"from controllers.console.error import NotAllowedCreateWorkspace\ntry:\n    verify_code(email, code, token)\nexcept NotAllowedCreateWorkspace:\n    prompt('Self-service workspace creation is disabled. Ask your admin to invite you.')","preventionTips":["Align is_workspace_creation_allowed with your onboarding policy.","Pre-invite users instead of letting tenant-less accounts hit this guard.","Document the invite-only policy in user-facing docs."],"tags":["auth","email-code-login","workspace","configuration","feature-flag"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}