mastra-ai/mastra · error · HTTPException

Access denied: agent has no memory configured to validate th

Error message

Access denied: agent has no memory configured to validate thread ownership

What it means

GET /agents/:agentId/suspended-runs enforces thread-scoped access: when a threadId filter is present, the server must verify the caller owns that thread before honoring the query. If the agent has no memory configured there is no storage to look the thread up in, so ownership cannot be verified and the server fails closed with HTTPException 403 rather than returning another user's suspended approvals.

Source

Thrown at packages/server/src/server/handlers/agents.ts:2678

        mastra,
        agentId,
        versionOptions: extractVersionOptions(requestContext),
      });

      // Honor server-enforced thread/resource scoping from the request context
      // so clients cannot list suspended runs outside their own scope.
      const effectiveResourceId = getEffectiveResourceId(requestContext, query.resourceId);
      const effectiveThreadId = getEffectiveThreadId(requestContext, query.threadId);

      // Validate ownership/FGA before honoring a thread filter — without this a
      // caller could probe another user's suspended approvals (including
      // tool-call args) by guessing a threadId. Reject when ownership cannot be
      // verified (no memory configured, or the thread does not exist) so a
      // thread-scoped query is never honored unchecked.
      if (effectiveThreadId) {
        const memory = await agent.getMemory({ requestContext });
        if (!memory) {
          throw new HTTPException(403, {
            message: 'Access denied: agent has no memory configured to validate thread ownership',
          });
        }
        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
        if (!thread) {
          throw new HTTPException(403, { message: 'Access denied: thread not found' });
        }
        await enforceThreadAccess({
          mastra,
          requestContext,
          threadId: effectiveThreadId,
          thread,
          effectiveResourceId,
        });
      }

      return await agent.listSuspendedRuns({
        threadId: effectiveThreadId,

View on GitHub (pinned to 75dd419e61)

Solutions

1. Configure memory on the agent (attach a Memory instance with storage) so thread ownership can be validated
2. Drop the threadId filter and list suspended runs agent-wide, relying on resourceId scoping instead
3. Use a different agent that has memory configured
4. If the flow truly needs no threads, stop sending threadId in query/context

Example fix

// before
export const agent = new Agent({ name: 'helper', instructions: '...' }); // no memory
// after
export const agent = new Agent({ name: 'helper', instructions: '...', memory: new Memory({ storage: new LibSQLStore({ url: process.env.DB_URL! }) }) });

const memory = agent.getMemory ? await agent.getMemory({}) : null;
if (threadId && !memory) throw new Error('threadId filter requires an agent with memory configured');

function canValidateThreads(a: unknown): a is { getMemory: () => Promise<unknown> } {
  return typeof a === 'object' && a !== null && typeof (a as any).getMemory === 'function';
}

try { await client.getAgent(agentId).listSuspendedRuns({ threadId }); } catch (e) { if (e?.status === 403 && /no memory configured/.test(e.message)) { return client.getAgent(agentId).listSuspendedRuns({ resourceId }); } throw e; }

When it happens

Trigger: Calling /agents/:agentId/suspended-runs?threadId=<id> (or with threadId supplied via request context) on an agent constructed without memory (no storage/libsql/mastra memory). Any thread-scoped listing on a memory-less agent triggers this.

Common situations: Agent defined without a memory block while the UI still passes threadId filters; storage not attached in a serverless/edge deployment; resource-scoped deployments where threadId comes from auth context automatically; confusion after removing memory from an agent config.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied: thread not found
• Access denied: unable to verify message thread access
• Access denied: cannot save messages for a different resource
• Access denied: thread belongs to a different resource
• Cookie password must be at least 32 characters for SSO. Set

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/bbba597ab1a1da69. Report an issue: GitHub.