langgenius/dify · error · NotAllowedCreateWorkspace

not_allowed_create_workspace

not_allowed_create_workspace

Error message

Workspace not found, please contact system admin to invite you to join in a workspace.

What it means

Raised by POST /console/api/email-code-login/validity (HTTP 400, code not_allowed_create_workspace) for an existing account with no tenants where the license has workspace slots available but FeatureService.is_workspace_creation_allowed() is false. The system will not auto-create a tenant for the account, so the user cannot proceed.

Source

Thrown at api/controllers/console/auth/login.py:321

            raise EmailCodeError()

        AccountService.revoke_email_code_login_token(req_data.token)
        try:
            account = _get_account_with_case_fallback(original_email)
        except Unauthorized as exc:
            _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_BANNED)
            raise AccountBannedError() from exc
        except AccountRegisterError:
            _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_IN_FREEZE)
            raise AccountInFreezeError()
        if account:
            tenants = TenantService.get_join_tenants(account, session=db.session())
            if not tenants:
                workspaces = FeatureService.get_license().workspaces
                if not workspaces.is_available():
                    raise WorkspacesLimitExceeded()
                if not FeatureService.is_workspace_creation_allowed():
                    raise NotAllowedCreateWorkspace()
                else:
                    TenantService.create_owner_tenant(account, session=db.session())

        if account is None:
            try:
                account = AccountService.create_account_and_tenant(
                    email=user_email,
                    name=user_email,
                    interface_language=get_valid_language(language),
                    timezone=req_data.timezone,
                    session=db.session(),
                )
            except WorkSpaceNotAllowedCreateError:
                raise NotAllowedCreateWorkspace()
            except SeatsLimitExceededError:
                raise SeatsLimitExceeded()
            except AccountRegisterError:
                _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_IN_FREEZE)

View on GitHub (pinned to ef8544b173)

Solutions

Have an admin invite the user to an existing workspace.
If appropriate, enable workspace creation via the feature flag backing FeatureService.is_workspace_creation_allowed().
Verify the account truly should be in a workspace; re-add them through the admin console.
Check FeatureService configuration source (license/config) for the creation flag.

Example fix

# before
if not FeatureService.is_workspace_creation_allowed():
    raise NotAllowedCreateWorkspace()
# after - keep the guard but expose a clearer next step
if not FeatureService.is_workspace_creation_allowed():
    raise NotAllowedCreateWorkspace(description='Self-service workspace creation is disabled. Ask your admin to invite you.')

Defensive patterns

Strategy: validation

Validate before calling

from services.feature_service import FeatureService

def can_self_create_workspace_for_existing() -> bool:
    return FeatureService.is_workspace_creation_allowed()

Type guard

null

Try / catch

from controllers.console.error import NotAllowedCreateWorkspace
try:
    verify_code(email, code, token)
except NotAllowedCreateWorkspace:
    prompt('Self-service workspace creation is disabled. Ask your admin to invite you.')

Prevention

Align is_workspace_creation_allowed with your onboarding policy.
Pre-invite users instead of letting tenant-less accounts hit this guard.
Document the invite-only policy in user-facing docs.

When it happens

Trigger: POST /console/api/email-code-login/validity for an existing, tenant-less account, where workspaces.is_available() is true but is_workspace_creation_allowed() returns false. The controller raises NotAllowedCreateWorkspace instead of creating an owner tenant.

Common situations: Admin disabled workspace creation (single-workspace policy); SSO-managed deployment where tenants are pre-provisioned; account removed from its workspace and the deployment forbids self-service workspace creation; misconfigured feature flag.

Related errors

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/a015793c1859bb4f. Report an issue: GitHub.