{"record":{"id":"bbdf7cfdf1181ab4","repo":"n8n-io/n8n","slug":"403-bbdf7c","errorCode":"403","errorMessage":"MFA enforcement is managed via environment variables and cannot be modified through the API","messagePattern":"MFA enforcement is managed via environment variables and cannot be modified through the API","errorType":"exception","errorClass":"ForbiddenError","httpStatus":403,"severity":"error","filePath":"packages/cli/src/controllers/mfa.controller.ts","lineNumber":35,"sourceCode":"import { MfaService } from '@/mfa/mfa.service';\nimport { MFA } from '@/requests';\n\n@RestController('/mfa')\nexport class MFAController {\n\tconstructor(\n\t\tprivate mfaService: MfaService,\n\t\tprivate externalHooks: ExternalHooks,\n\t\tprivate authService: AuthService,\n\t\tprivate userRepository: UserRepository,\n\t\tprivate eventService: EventService,\n\t\tprivate instanceSettingsLoaderConfig: InstanceSettingsLoaderConfig,\n\t) {}\n\n\t@Post('/enforce-mfa')\n\t@GlobalScope('user:enforceMfa')\n\tasync enforceMFA(req: MFA.Enforce) {\n\t\tif (this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t'MFA enforcement is managed via environment variables and cannot be modified through the API',\n\t\t\t);\n\t\t}\n\n\t\tif (req.body.enforce && !(req.authInfo?.usedMfa ?? false)) {\n\t\t\t// The current user tries to enforce MFA, but does not have\n\t\t\t// MFA set up for them self. We are forbidding this, to\n\t\t\t// help the user not lock them selfs out.\n\t\t\tthrow new BadRequestError(\n\t\t\t\t'You must enable two-factor authentication on your own account before enforcing it for all users',\n\t\t\t);\n\t\t}\n\t\tawait this.mfaService.enforceMFA(req.body.enforce);\n\n\t\tthis.eventService.emit('instance-policies-updated', {\n\t\t\tuser: {\n\t\t\t\tid: req.user.id,\n\t\t\t\temail: req.user.email,","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/mfa.controller.ts#L17-L53","documentation":"POST /rest/mfa/enforce-mfa is disabled because `instanceSettingsLoaderConfig.securityPolicyManagedByEnv` is true — the instance runs with env-driven security policy. In this mode, MFA enforcement can only be changed via environment variables, never through the API, so the endpoint refuses with 403.","triggerScenarios":"POST /rest/mfa/enforce-mfa while `securityPolicyManagedByEnv` config flag is true.","commonSituations":"Enterprise/containerised deployment where security policies are pinned via env vars; helm/k8s chart sets the managed-by-env flag.","solutions":["Toggle MFA enforcement through the relevant environment variable (e.g. the security/MFA env knob defined by your n8n version) and restart the instance.","If API control is required, unset the `securityPolicyManagedByEnv` flag in config so the API path is re-enabled."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Expose securityPolicyManagedByEnv via /settings and gate the UI control.\nif (settings.securityPolicyManagedByEnv) {\n  disableMfaEnforceToggle('MFA enforcement is env-managed — set it via environment variable.');\n  return;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reflect the env-managed flag in the admin UI so the toggle is hidden/disabled.","Document the relevant env var next to the disabled control.","Restart n8n after changing the env var so config reloads."],"tags":["mfa","config","environment","enterprise","security-policy"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}