{"record":{"id":"d7451b251ba9ebf0","repo":"n8n-io/n8n","slug":"method-methodname-is-not-an-allowed-sdk-metho","errorCode":null,"errorMessage":"Method '${methodName}' is not an allowed SDK method. Allowed methods: ${allowedMethodNames().join(', ')}. Native array/string methods are not available in SDK code; use a Code node or an n8n expression for runtime logic.","messagePattern":"Method '(.+?)' is not an allowed SDK method\\. Allowed methods: (.+?)\\. Native array/string methods are not available in SDK code; use a Code node or an n8n expression for runtime logic\\.","errorType":"exception","errorClass":"SecurityError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/workflow-sdk/src/ast-interpreter/interpreter.ts","lineNumber":273,"sourceCode":"\t\t\t\tconst safeMethod = getSafeJSONMethod(memberExpr.object.name, methodName);\n\t\t\t\tif (safeMethod) {\n\t\t\t\t\tconst args = node.arguments.map((arg) => this.evaluate(arg));\n\t\t\t\t\treturn safeMethod(...args);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tthisArg = this.evaluate(memberExpr.object);\n\n\t\t\t// Handle safe string methods (e.g. \"abc\".repeat(3))\n\t\t\tconst safeStringMethod = getSafeStringMethod(thisArg, methodName);\n\t\t\tif (safeStringMethod) {\n\t\t\t\tconst args = node.arguments.map((arg) => this.evaluate(arg));\n\t\t\t\treturn safeStringMethod(...args);\n\t\t\t}\n\n\t\t\t// Validate method name against allowlist\n\t\t\tif (!isAllowedMethod(methodName)) {\n\t\t\t\tthrow new SecurityError(\n\t\t\t\t\tmethodName,\n\t\t\t\t\tmemberExpr.property.loc ?? undefined,\n\t\t\t\t\tthis.sourceCode,\n\t\t\t\t\t`Method '${methodName}' is not an allowed SDK method. ` +\n\t\t\t\t\t\t`Allowed methods: ${allowedMethodNames().join(', ')}. ` +\n\t\t\t\t\t\t'Native array/string methods are not available in SDK code; ' +\n\t\t\t\t\t\t'use a Code node or an n8n expression for runtime logic.',\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tif (thisArg && typeof thisArg === 'object') {\n\t\t\t\tfunc = (thisArg as Record<string, unknown>)[methodName];\n\t\t\t}\n\t\t} else {\n\t\t\tthrow new UnsupportedNodeError(\n\t\t\t\t`Callee type ${node.callee.type}`,\n\t\t\t\tnode.callee.loc ?? undefined,\n\t\t\t\tthis.sourceCode,","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/workflow-sdk/src/ast-interpreter/interpreter.ts#L255-L291","documentation":"Method calls on objects are restricted to the `ALLOWED_METHODS` set: `add`, `to`, `group`, `input`, `output`, `onError`, `onTrue`, `onFalse`, `onCase`, `onEachBatch`, `onDone`, `connect`, `toJSON`, `validate`. Native JavaScript methods (`.push()`, `.map()`, `.filter()`, `.split()`, `.join()`, etc.) are not available. The only exceptions are `JSON.stringify` and two string methods (`.repeat()`, `.trim()`) which have dedicated safe wrappers checked before the allowlist.","triggerScenarios":"Calling `items.push(x)`, `text.split(',')`, `arr.map(fn)`, `obj.keys()`, or any native method. At interpreter.ts:264-282, the interpreter first checks `getSafeStringMethod` (for `.repeat`/`.trim` on strings), then `isAllowedMethod`. If neither matches, it throws `SecurityError`.","commonSituations":"Trying to manipulate arrays or strings in SDK code (the most common porting mistake); expecting standard JS collection methods; data transformation logic that belongs in a Code node.","solutions":["Use only SDK builder methods (`add`, `to`, `group`, `input`, `output`, `connect`, etc.)","For JSON: use `JSON.stringify()` — it is the only allowed JSON method (parse is not available)","For strings: use `.repeat()` or `.trim()` — the only allowed string methods","For any other data transformation (map, filter, split, join, sort): move it to a Code node or an n8n expression"],"exampleFix":"// before\nconst names = items.map((i) => i.name);\n\n// after\n// (array methods are not available in SDK code — move to a Code node)\n// In SDK code, build structures with SDK functions instead:\nconst wf = workflow({ name: 'X' });\nwf.add({ name: items[0].name });","handlingStrategy":"validation","validationCode":"import { ALLOWED_METHODS } from '@n8n/workflow-sdk/ast-interpreter/validators';\n\nconst SAFE_JSON = new Set(['stringify']);\nconst SAFE_STRING = new Set(['repeat', 'trim']);\n\nfunction findDisallowedMethods(code: string): string[] {\n  const ast = parse(code, { ecmaVersion: 'latest', sourceType: 'module' });\n  const bad: string[] = [];\n  walk(ast, (node) => {\n    if (node.type === 'CallExpression' && node.callee.type === 'MemberExpression') {\n      const prop = node.callee.property;\n      const name = prop.type === 'Identifier' ? prop.name : null;\n      if (name && !ALLOWED_METHODS.has(name) && !SAFE_JSON.has(name) && !SAFE_STRING.has(name)) {\n        bad.push(name);\n      }\n    }\n  });\n  return bad;\n}","typeGuard":null,"tryCatchPattern":"import { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';\n\ntry {\n  interpretSDKCode(sdkCode, sdkFunctions);\n} catch (e) {\n  if (e instanceof SecurityError && e.message.includes('not an allowed SDK method')) {\n    // show the allowed method list and suggest a Code node for data transformation\n  }\n  throw e;\n}","preventionTips":["Memorize the allowed methods: `add`, `to`, `group`, `input`, `output`, `onError`, `onTrue`, `onFalse`, `onCase`, `onEachBatch`, `onDone`, `connect`","Only `JSON.stringify`, `.repeat()`, and `.trim()` are available as native methods","Move all array/string manipulation (map, filter, split, join, sort) to a Code node"],"tags":["sdk-interpreter","method-allowlist","native-methods","security"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}