{"record":{"id":"fa2e5b7f47ccf5c1","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-fa2e5b","errorCode":"error-action-not-allowed","errorMessage":"Importing is not allowed","messagePattern":"Importing is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/import/startImport.ts","lineNumber":49,"sourceCode":"\t\tstartImport(params: StartImportParamsPOST): void;\n\t}\n}\n\nMeteor.methods<ServerMethods>({\n\tasync startImport({ input }: StartImportParamsPOST) {\n\t\tmethodDeprecationLogger.method('startImport', '9.0.0', '/v1/startImport');\n\t\tif (!input || typeof input !== 'object' || !isStartImportParamsPOST({ input })) {\n\t\t\tthrow new Meteor.Error(`Invalid Selection data provided to the importer.`);\n\t\t}\n\n\t\tconst userId = Meteor.userId();\n\t\t// Takes name and object with users / channels selected to import\n\t\tif (!userId) {\n\t\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', 'startImport');\n\t\t}\n\n\t\tif (!(await hasPermissionAsync(userId, 'run-import'))) {\n\t\t\tthrow new Meteor.Error('error-action-not-allowed', 'Importing is not allowed', 'startImport');\n\t\t}\n\n\t\treturn executeStartImport({ input }, userId);\n\t},\n});\n","sourceCodeStart":31,"sourceCodeEnd":55,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/import/startImport.ts#L31-L55","documentation":"startImport requires `run-import`; users without the permission get error-action-not-allowed before executeStartImport runs. The permission defaults to the admin role only, mirroring every other mutating import method.","triggerScenarios":"A logged-in non-admin calls `Meteor.call('startImport', ...)`; or run-import was revoked from a custom role that previously could import.","commonSituations":"Delegating import execution to non-admin staff without granting run-import; token/service accounts created without the permission; permission matrix changes after a role audit.","solutions":["Grant run-import to the caller's role or run as admin","Disable/gate the Start Import button with a permission check so the method is never invoked","For REST, use a token belonging to a role with run-import"],"exampleFix":"// before\nMeteor.call('startImport', { input }, cb); // error-action-not-allowed\n\n// after\nconst canImport = usePermission('run-import');\nif (canImport) Meteor.call('startImport', { input }, cb);","handlingStrategy":"validation","validationCode":"const canRunImport = usePermission('run-import');\nif (canRunImport) Meteor.call('startImport', { input }, cb);","typeGuard":null,"tryCatchPattern":"Meteor.call('startImport', { input }, (err) => {\n  if (err && (err as Meteor.Error).error === 'error-action-not-allowed') {\n    // needs run-import — surface permission message, no retry\n  }\n});","preventionTips":["Disable the Start button for users without run-import","Assign the permission before delegating import work","Audit custom roles for run-import after permission cleanups"],"tags":["rocket-chat","permissions","import","meteor-methods"],"backgroundTag":"insufficient-permissions","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}