{"record":{"id":"a34a0b2e8eb8677c","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-permissions","errorCode":"error-invalid-permissions","errorMessage":"Invalid permission for required Integration creation.","messagePattern":"Invalid permission for required Integration creation\\.","errorType":"validation","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/integrations/lib/validateOutgoingIntegration.ts","lineNumber":140,"sourceCode":"\tlet channels: string[] = [];\n\tif (outgoingEvents[integration.event].use.channel) {\n\t\tif (!Match.test(integration.channel, String)) {\n\t\t\tthrow new Meteor.Error('error-invalid-channel', 'Invalid Channel', {\n\t\t\t\tfunction: 'validateOutgoing',\n\t\t\t});\n\t\t} else {\n\t\t\tchannels = parseCSV(integration.channel);\n\n\t\t\tfor (const channel of channels) {\n\t\t\t\tif (!validChannelChars.includes(channel[0]) && !scopedChannels.includes(channel.toLowerCase())) {\n\t\t\t\t\tthrow new Meteor.Error('error-invalid-channel-start-with-chars', 'Invalid channel. Start with @ or #', {\n\t\t\t\t\t\tfunction: 'validateOutgoing',\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} else if (!(await hasPermissionAsync(userId, 'manage-outgoing-integrations'))) {\n\t\tthrow new Meteor.Error('error-invalid-permissions', 'Invalid permission for required Integration creation.', {\n\t\t\tfunction: 'validateOutgoing',\n\t\t});\n\t}\n\n\tconst user = await Users.findOne({ username: integration.username });\n\n\tif (!user) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user (did you delete the `rocket.cat` user?)', { function: 'validateOutgoing' });\n\t}\n\n\tconst integrationData: IOutgoingIntegration = {\n\t\t...integration,\n\t\tscriptEngine: integration.scriptEngine ?? 'isolated-vm',\n\t\ttype: 'webhook-outgoing',\n\t\tchannel: channels,\n\t\tuserId: user._id,\n\t\t_createdAt: new Date(),\n\t\t_createdBy: await Users.findOne(userId, { projection: { username: 1 } }),","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/integrations/lib/validateOutgoingIntegration.ts#L122-L158","documentation":"Thrown in validateOutgoing for events that do not use channels — roomArchived, roomCreated, userCreated — when the creating user lacks manage-outgoing-integrations. Because these events fire workspace-wide rather than per-channel, creating such integrations is restricted to users who can manage outgoing integrations; everyone else gets Meteor.Error code 'error-invalid-permissions'.","triggerScenarios":"A non-admin calls integrations.create with type 'webhook-outgoing' and event 'roomCreated', 'roomArchived', or 'userCreated' while their role lacks manage-outgoing-integrations. The else-branch of the use.channel check fires because there is no channel list to authorize against.","commonSituations":"Workspace-audit or provisioning bots that want room/user lifecycle events; users who successfully created sendMessage integrations (authorized via room membership) and assume all events work the same way.","solutions":["Grant the creator's role manage-outgoing-integrations in Admin -> Permissions, then retry","Or have an admin create the lifecycle integration and share the resulting token/URL with the team","If you only need per-room events, switch to a channel-using event (e.g. sendMessage) which authorizes via room membership"],"exampleFix":"// before — non-admin creates a lifecycle integration\n{ type: 'webhook-outgoing', event: 'roomCreated', ... }\n\n// after — grant the permission first\n// Admin -> Permissions -> creator's role -> manage-outgoing-integrations = On","handlingStrategy":"validation","validationCode":"const EVENTS_WITHOUT_CHANNEL = ['roomArchived', 'roomCreated', 'userCreated'];\nif (EVENTS_WITHOUT_CHANNEL.includes(event) && !(await hasPermissionAsync(userId, 'manage-outgoing-integrations'))) {\n  throw new Error('only users with manage-outgoing-integrations may create this event type');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Hide lifecycle events (roomArchived, roomCreated, userCreated) from users without manage-outgoing-integrations","Document that channel-less events are admin-only in internal tooling"],"tags":["integrations","outgoing-webhook","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}