langgenius/dify · error · NotAllowedCreateWorkspace

not_allowed_create_workspace

not_allowed_create_workspace

Error message

Workspace not found, please contact system admin to invite you to join in a workspace.

What it means

Raised by POST /console/api/email-code-login/validity (HTTP 400, code not_allowed_create_workspace) for an existing account with no tenants where the license has workspace slots available but FeatureService.is_workspace_creation_allowed() is false. The system will not auto-create a tenant for the account, so the user cannot proceed.

Solutions

Have an admin invite the user to an existing workspace.
If appropriate, enable workspace creation via the feature flag backing FeatureService.is_workspace_creation_allowed().
Verify the account truly should be in a workspace; re-add them through the admin console.
Check FeatureService configuration source (license/config) for the creation flag.

Example fix

# before
if not FeatureService.is_workspace_creation_allowed():
    raise NotAllowedCreateWorkspace()
# after - keep the guard but expose a clearer next step
if not FeatureService.is_workspace_creation_allowed():
    raise NotAllowedCreateWorkspace(description='Self-service workspace creation is disabled. Ask your admin to invite you.')

Defensive patterns

Strategy: validation

Validate before calling

from services.feature_service import FeatureService

def can_self_create_workspace_for_existing() -> bool:
    return FeatureService.is_workspace_creation_allowed()

Type guard

null

Try / catch

from controllers.console.error import NotAllowedCreateWorkspace
try:
    verify_code(email, code, token)
except NotAllowedCreateWorkspace:
    prompt('Self-service workspace creation is disabled. Ask your admin to invite you.')

Prevention

Align is_workspace_creation_allowed with your onboarding policy.
Pre-invite users instead of letting tenant-less accounts hit this guard.
Document the invite-only policy in user-facing docs.

When it happens

Trigger: POST /console/api/email-code-login/validity for an existing, tenant-less account, where workspaces.is_available() is true but is_workspace_creation_allowed() returns false. The controller raises NotAllowedCreateWorkspace instead of creating an owner tenant.

Common situations: Admin disabled workspace creation (single-workspace policy); SSO-managed deployment where tenants are pre-provisioned; account removed from its workspace and the deployment forbids self-service workspace creation; misconfigured feature flag.

Related errors

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/a015793c1859bb4f. Report an issue: GitHub.

Appendix: source

Thrown at api/controllers/console/auth/login.py:321

            raise EmailCodeError()

        AccountService.revoke_email_code_login_token(req_data.token)
        try:
            account = _get_account_with_case_fallback(original_email)
        except Unauthorized as exc:
            _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_BANNED)
            raise AccountBannedError() from exc
        except AccountRegisterError:
            _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_IN_FREEZE)
            raise AccountInFreezeError()
        if account:
            tenants = TenantService.get_join_tenants(account, session=db.session())
            if not tenants:
                workspaces = FeatureService.get_license().workspaces
                if not workspaces.is_available():
                    raise WorkspacesLimitExceeded()
                if not FeatureService.is_workspace_creation_allowed():
                    raise NotAllowedCreateWorkspace()
                else:
                    TenantService.create_owner_tenant(account, session=db.session())

        if account is None:
            try:
                account = AccountService.create_account_and_tenant(
                    email=user_email,
                    name=user_email,
                    interface_language=get_valid_language(language),
                    timezone=req_data.timezone,
                    session=db.session(),
                )
            except WorkSpaceNotAllowedCreateError:
                raise NotAllowedCreateWorkspace()
            except SeatsLimitExceededError:
                raise SeatsLimitExceeded()
            except AccountRegisterError:
                _log_console_login_failure(email=user_email, reason=LoginFailureReason.ACCOUNT_IN_FREEZE)

View on GitHub (pinned to ef8544b173)