{"record":{"id":"dcec340c339e1de7","repo":"RocketChat/Rocket.Chat","slug":"error-abac-not-enabled","errorCode":"error-abac-not-enabled","errorMessage":"error-abac-not-enabled","messagePattern":"error-abac-not-enabled","errorType":"http","errorClass":"Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/ee/server/api/abac/index.ts","lineNumber":69,"sourceCode":"\t\t'abac/rooms/:rid/attributes',\n\t\t{\n\t\t\tauthRequired: true,\n\t\t\tpermissionsRequired: ['abac-management', 'manage-abac-admin-rooms'],\n\t\t\tbody: POSTRoomAbacAttributesBodySchema,\n\t\t\tresponse: {\n\t\t\t\t200: GenericSuccessSchema,\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t\t400: GenericErrorSchema,\n\t\t\t\t403: validateUnauthorizedErrorResponse,\n\t\t\t},\n\t\t\tlicense: ['abac'],\n\t\t},\n\t\tasync function action() {\n\t\t\tconst { rid } = this.urlParams;\n\t\t\tconst { attributes } = this.bodyParams;\n\n\t\t\tif (!settings.get('ABAC_Enabled')) {\n\t\t\t\tthrow new Error('error-abac-not-enabled');\n\t\t\t}\n\n\t\t\t// This is a replace-all operation\n\t\t\t// IF you need fine grained, use the other endpoints for removing, editing & adding single attributes\n\t\t\tawait Abac.setRoomAbacAttributes(rid, attributes, getActorFromUser(this.user));\n\t\t\treturn API.v1.success();\n\t\t},\n\t)\n\t.delete(\n\t\t'abac/rooms/:rid/attributes',\n\t\t{\n\t\t\tauthRequired: true,\n\t\t\tpermissionsRequired: ['abac-management', 'manage-abac-admin-rooms'],\n\t\t\tresponse: {\n\t\t\t\t200: GenericSuccessSchema,\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t\t400: GenericErrorSchema,\n\t\t\t\t403: validateUnauthorizedErrorResponse,","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/ee/server/api/abac/index.ts#L51-L87","documentation":"Thrown as Error('error-abac-not-enabled') in the POST abac/rooms/:rid/attributes action when settings.get('ABAC_Enabled') is falsy. This replace-all room-attributes endpoint refuses to run unless the ABAC feature is enabled, even though the license gate and permissions already passed.","triggerScenarios":"Calling POST /api/v1/abac/rooms/:rid/attributes while ABAC_Enabled setting is false/off; ABAC licensed and permitted but the admin never toggled the setting on; setting reset during maintenance.","commonSituations":"Workspace has the ABAC license and role permissions but ABAC_Enabled is still off; integration/script that assumes ABAC is on.","solutions":["Enable ABAC via admin settings (ABAC_Enabled = true) before calling the endpoint.","Verify the setting persisted and was pushed to the client/cache.","Gate the caller UI so the room-attributes mutation is only offered when ABAC is enabled."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Read ABAC_Enabled before offering the replace-all attributes action.\nconst abacEnabled = useSetting('ABAC_Enabled');\nif (!abacEnabled) { /* hide/disable the bulk set attributes button */ }","typeGuard":null,"tryCatchPattern":"try {\n  await fetch('/api/v1/abac/rooms/:rid/attributes', { method: 'POST', body: ... });\n} catch (e) {\n  if (e?.error === 'error-abac-not-enabled') {\n    // prompt admin to enable ABAC\n  } else throw e;\n}","preventionTips":["Enable ABAC_Enabled before exposing/using ABAC endpoints.","Gate admin UI controls on the setting value.","Verify the setting propagated after toggling."],"tags":["ee","abac","server","rest-api","settings"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}