mastra-ai/mastra · error · HTTPException

Access denied: thread not found

Error message

Access denied: thread not found

What it means

When listing suspended runs with a threadId filter, the server looks the thread up via memory.getThreadById and rejects with HTTPException 403 if no thread with that id exists. This fails closed to prevent probing other users' suspended tool calls by guessing thread ids; a nonexistent thread is indistinguishable from one you do not own.

Source

Thrown at packages/server/src/server/handlers/agents.ts:2684

      // so clients cannot list suspended runs outside their own scope.
      const effectiveResourceId = getEffectiveResourceId(requestContext, query.resourceId);
      const effectiveThreadId = getEffectiveThreadId(requestContext, query.threadId);

      // Validate ownership/FGA before honoring a thread filter — without this a
      // caller could probe another user's suspended approvals (including
      // tool-call args) by guessing a threadId. Reject when ownership cannot be
      // verified (no memory configured, or the thread does not exist) so a
      // thread-scoped query is never honored unchecked.
      if (effectiveThreadId) {
        const memory = await agent.getMemory({ requestContext });
        if (!memory) {
          throw new HTTPException(403, {
            message: 'Access denied: agent has no memory configured to validate thread ownership',
          });
        }
        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
        if (!thread) {
          throw new HTTPException(403, { message: 'Access denied: thread not found' });
        }
        await enforceThreadAccess({
          mastra,
          requestContext,
          threadId: effectiveThreadId,
          thread,
          effectiveResourceId,
        });
      }

      return await agent.listSuspendedRuns({
        threadId: effectiveThreadId,
        resourceId: effectiveResourceId,
        fromDate: query.fromDate,
        toDate: query.toDate,
        perPage: query.perPage,
        page: query.page,
      });

View on GitHub (pinned to 75dd419e61)

Solutions

1. Verify the threadId against the configured storage (memory.getThreadById or the threads API) before filtering on it
2. Check the server is connected to the storage backend where the thread was created (same DB_URL/environment)
3. Re-fetch the current thread list for the resourceId and use a valid id
4. Remove the threadId filter and list suspended runs scoped by resourceId only

Example fix

// before
const runs = await client.getAgent('a').listSuspendedRuns({ threadId: cachedThreadId }); // stale id
// after
const thread = await client.getMemoryThread(cachedThreadId).catch(() => null);
const runs = thread ? await client.getAgent('a').listSuspendedRuns({ threadId: cachedThreadId }) : await client.getAgent('a').listSuspendedRuns({ resourceId });

const thread = await memory.getThreadById({ threadId });
if (!thread) throw new Error(`Thread ${threadId} does not exist in configured storage`);

function isExistingThread(t: unknown): t is { id: string } {
  return typeof t === 'object' && t !== null && typeof (t as any).id === 'string' && (t as any).id.length > 0;
}

try { return await listSuspendedRuns({ threadId }); } catch (e) { if (e?.status === 403 && /thread not found/.test(e.message)) { return listSuspendedRuns({ resourceId }); } throw e; }

When it happens

Trigger: GET /agents/:agentId/suspended-runs?threadId=X where X does not exist in the configured memory storage — e.g. deleted thread, typo'd id, wrong storage backend (pointing at a different database), or thread created in another environment.

Common situations: Stale UI caches holding thread ids from deleted threads; switching storage providers (dev vs prod database) so ids no longer resolve; passing a resourceId-less thread id from another tenant; ids truncated or reformatted by client code.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied: agent has no memory configured to validate th
• Cookie password must be at least 32 characters for SSO. Set
• [MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Go
• Invalid Google ID token nonce
• Cookie password must be at least 32 characters. Set OKTA_COO

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/9339583cc4e1a1af. Report an issue: GitHub.