hcengineering/platform · warning · PlatformError

addSession: rejected by account service

Error message

addSession: rejected by account service

What it means

Later in addSession, after workspace resolution, attaching the session can still be rejected by the account service with a PlatformError. The message is logged with the workspace UUID and status code, and the client receives the error status with terminate:true — the account service refused the session (authorization, quota, or workspace state).

Source

Thrown at foundations/server/packages/server/src/sessionManager.ts:829

            ])
          }

          // Mark workspace as init completed and we had at least one client.
          if (!workspace.workspaceInitCompleted) {
            workspace.workspaceInitCompleted = true
          }

          if (this.timeMinutes > 0) {
            void ws
              .send(ctx, { result: this.createMaintenanceWarning() }, session.binaryMode, session.useCompression)
              .catch((err) => {
                ctx.error('failed to send maintenance warning', err)
              })
          }
          return { session, context: workspace.context, workspaceId: workspace.wsId.uuid }
        } catch (err: unknown) {
          if (err instanceof PlatformError) {
            ctx.warn('addSession: rejected by account service', {
              workspaceUuid: token.workspace,
              code: err.status.code,
              source: token.extra?.service ?? '🤦‍♂️user'
            })
            return { error: err.status, terminate: true }
          }
          throw err
        }
      })
    )
  }

  private async switchToUpgradeSession (
    token: Token,
    ctx: MeasureContext,
    workspace: Workspace,
    ws: ConnectionSocket
  ): Promise<void> {

View on GitHub (pinned to 63e28dc964)

Solutions

1. Read err.status.code from the returned error to identify the rejection reason
2. Free up seats / upgrade the workspace limit if quota-related
3. Re-enable the account or obtain a new token with correct privileges
4. Check account service logs for the matching rejection

Example fix

// before
socket.connect({ token }) // rejected: workspace seats exhausted
// after
try {
  socket.connect({ token })
} catch (e) {
  if (e.status?.code === LIMIT_REACHED) {
    await upgradeWorkspaceSeats(workspace)
    socket.connect({ token })
  }
}

const seats = await accountClient.getSessionUsage(workspaceUuid)
if (seats.used >= seats.limit) throw new Error('session limit reached')

function isPlatformError(e: unknown): e is PlatformError {
  return e instanceof PlatformError
}

try {
  await connect(token)
} catch (err) {
  if (isPlatformError(err)) {
    if (err.status.code === LIMIT_REACHED) await upgradePlan()
    else await reauthenticate()
  } else throw err
}

When it happens

Trigger: Workspace is full (seat/limit exceeded), account is disabled, token lacks required privileges, or the account service rejects session creation for policy reasons during WebSocket connect.

Common situations: Exceeded concurrent-session or user limits; account deactivated/banned between token issuance and connect; rate limiting by the account service.

Related errors

• addSession: getWorkspaceInfo failed
• Forbidden
• Message id is required
• Unknown content format
• Hierarchy is not defined

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/ddd60d374e387cc9. Report an issue: GitHub.