{"record":{"id":"eccda3d0b31a29ec","repo":"Mintplex-Labs/anything-llm","slug":"unauthorized","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"server/endpoints/api/admin/index.js","lineNumber":73,"sourceCode":"                }\n             ]\n            }\n          }\n        }\n      }\n    }\n    #swagger.responses[403] = {\n      schema: {\n        \"$ref\": \"#/definitions/InvalidAPIKey\"\n      }\n    }\n     #swagger.responses[401] = {\n      description: \"Instance is not in Multi-User mode. Method denied\",\n    }\n    */\n    try {\n      if (!multiUserMode(response)) {\n        response.sendStatus(401).end();\n        return;\n      }\n\n      const users = await User.where();\n      response.status(200).json({ users });\n    } catch (e) {\n      console.error(e);\n      response.sendStatus(500).end();\n    }\n  });\n\n  app.post(\"/v1/admin/users/new\", [validApiKey], async (request, response) => {\n    /*\n    #swagger.tags = ['Admin']\n    #swagger.description = 'Create a new user with username and password. Methods are disabled until multi user mode is enabled via the UI.'\n    #swagger.requestBody = {\n        description: 'Key pair object that will define the new user to add to the system.',\n        required: true,","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/endpoints/api/admin/index.js#L55-L91","documentation":"GET /v1/admin/users (server/endpoints/api/admin/index.js:41) returns HTTP 401 via response.sendStatus(401).end() at line 73 when `!multiUserMode(response)` is true. multiUserMode reads response.locals.multiUserMode, which was set by the validApiKey middleware from SystemSettings.isMultiUserMode(). This is an intentional denial: the admin user-management API is disabled on single-user instances.","triggerScenarios":"Calling GET /v1/admin/users with a valid API key on an instance where multi-user mode has not been enabled via the UI; the SystemSettings multi_user_mode flag being false; an instance provisioned as single-user that the operator tried to drive via the admin REST API.","commonSituations":"Default Docker/standalone install (single-user by default) being automated through /v1/admin/* endpoints before the operator enabled multi-user mode; a freshly restored backup where the multi_user_mode system setting was reset; testing locally without first running the multi-user setup wizard.","solutions":["Enable multi-user mode in the UI (Admin > Multi-User Mode) before calling any /v1/admin/users endpoint.","If automating, first call GET /v1/admin/is-multi-user-mode to confirm the flag, then enable it via the UI or DB before retrying.","For single-user workflows, use the workspace/document APIs instead of the admin user APIs.","Verify SystemSettings.isMultiUserMode() returns true in the database (system_settings row with label 'multi_user_mode' set to 'true')."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client-side gate\nconst r = await fetch('/api/v1/admin/is-multi-user-mode', { headers: authHeaders() });\nconst { isMultiUser } = await r.json();\nif (!isMultiUser) throw new Error('Enable multi-user mode before calling /v1/admin/users');","typeGuard":null,"tryCatchPattern":"if (!multiUserMode(response)) {\n  // 401 by design — surface a clear message to the operator\n  return response.status(401).json({ error:'Enable multi-user mode to use this endpoint' });\n}","preventionTips":["Enable multi-user mode via the UI before automating /v1/admin/*.","Gate automation on GET /v1/admin/is-multi-user-mode returning true.","Verify system_settings.multi_user_mode reads 'true' after setup."],"tags":["express","api","admin-api","multi-user-mode","authorization"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}