{"record":{"id":"ad1a024bf07e6005","repo":"FlowiseAI/Flowise","slug":"error-credentialscontroller-revealcredentialbyid","errorCode":null,"errorMessage":"Error: credentialsController.revealCredentialById - id not provided!","messagePattern":"Error: credentialsController\\.revealCredentialById - id not provided!","errorType":"exception","errorClass":"InternalFlowiseError","httpStatus":412,"severity":"warning","filePath":"packages/server/src/controllers/credentials/index.ts","lineNumber":86,"sourceCode":"        }\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {\n            throw new InternalFlowiseError(\n                StatusCodes.NOT_FOUND,\n                `Error: credentialsController.getCredentialById - workspace ${workspaceId} not found!`\n            )\n        }\n        const apiResponse = await credentialsService.getCredentialById(req.params.id, workspaceId)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n\nconst revealCredentialById = async (req: Request, res: Response, next: NextFunction) => {\n    try {\n        if (typeof req.params === 'undefined' || !req.params.id) {\n            throw new InternalFlowiseError(\n                StatusCodes.PRECONDITION_FAILED,\n                `Error: credentialsController.revealCredentialById - id not provided!`\n            )\n        }\n        const workspaceId = req.user?.activeWorkspaceId\n        if (!workspaceId) {\n            throw new InternalFlowiseError(\n                StatusCodes.NOT_FOUND,\n                `Error: credentialsController.revealCredentialById - workspace ${workspaceId} not found!`\n            )\n        }\n        const apiResponse = await credentialsService.revealCredentialById(req.params.id, workspaceId)\n        return res.json(apiResponse)\n    } catch (error) {\n        next(error)\n    }\n}\n","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/server/src/controllers/credentials/index.ts#L68-L104","documentation":"Thrown by revealCredentialById when req.params.id is missing or empty. revealCredentialById is the sensitive endpoint that decrypts credential secrets, so it guards id first. Identical shape to the other id-not-provided errors. Returns HTTP 412 PRECONDITION_FAILED.","triggerScenarios":"GET /api/v1/credentials/:id/reveal (or equivalent) called with no id segment, an empty id, or a literal 'undefined'/'null' string in the URL.","commonSituations":"Frontend reveals a credential before one is selected in the UI (selectedCredential is null). Misconfigured route that drops :id. Programmatic client reusing a stale id variable.","solutions":["Confirm the request URL contains a real UUID in the id position (check the network tab).","On the client, only call reveal when a credential is selected and its id is a non-empty string.","Gate the reveal action behind a user gesture (button click) that always has the row's id in scope.","Verify the route registration includes :id (e.g. app.get('/credentials/:id/reveal', ...))."],"exampleFix":"// before\nconst reveal = () => api.revealCredentialById(selectedId) // selectedId may be null\n\n// after\nconst reveal = () => {\n  if (!selectedId) return // no-op when nothing selected\n  return api.revealCredentialById(selectedId)\n}","handlingStrategy":"type-guard","validationCode":"function requireCredentialId(id: unknown): string {\n  if (typeof id !== 'string' || id.trim().length === 0) {\n    throw new Error('credential id required before reveal')\n  }\n  return id\n}\n\nconst id = requireCredentialId(selectedCredentialId)\nawait api.revealCredentialById(id)","typeGuard":"function isNonEmptyString(v: unknown): v is string {\n  return typeof v === 'string' && v.length > 0\n}","tryCatchPattern":"try {\n  await api.revealCredentialById(id)\n} catch (e) {\n  if (e.status === 412 && /id not provided/.test(e.message)) {\n    // caller bug — surface to the user as 'select a credential first'\n    notify('Select a credential first')\n    return\n  }\n  throw e\n}","preventionTips":["Only render the Reveal button when a row is selected with a non-empty id.","Bind reveal actions to a user gesture that carries the row's id, not to a global state that may be null.","URL-encode the id when interpolating into the request path."],"tags":["validation","rest-params","client-bug","credentials","flowise","secrets"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}