n8n-io/n8n · error · ForbiddenError

403

403

Error message

MFA enforcement is managed via environment variables and cannot be modified through the API

What it means

POST /rest/mfa/enforce-mfa is disabled because `instanceSettingsLoaderConfig.securityPolicyManagedByEnv` is true — the instance runs with env-driven security policy. In this mode, MFA enforcement can only be changed via environment variables, never through the API, so the endpoint refuses with 403.

Source

Thrown at packages/cli/src/controllers/mfa.controller.ts:35

import { MfaService } from '@/mfa/mfa.service';
import { MFA } from '@/requests';

@RestController('/mfa')
export class MFAController {
	constructor(
		private mfaService: MfaService,
		private externalHooks: ExternalHooks,
		private authService: AuthService,
		private userRepository: UserRepository,
		private eventService: EventService,
		private instanceSettingsLoaderConfig: InstanceSettingsLoaderConfig,
	) {}

	@Post('/enforce-mfa')
	@GlobalScope('user:enforceMfa')
	async enforceMFA(req: MFA.Enforce) {
		if (this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv) {
			throw new ForbiddenError(
				'MFA enforcement is managed via environment variables and cannot be modified through the API',
			);
		}

		if (req.body.enforce && !(req.authInfo?.usedMfa ?? false)) {
			// The current user tries to enforce MFA, but does not have
			// MFA set up for them self. We are forbidding this, to
			// help the user not lock them selfs out.
			throw new BadRequestError(
				'You must enable two-factor authentication on your own account before enforcing it for all users',
			);
		}
		await this.mfaService.enforceMFA(req.body.enforce);

		this.eventService.emit('instance-policies-updated', {
			user: {
				id: req.user.id,
				email: req.user.email,

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Toggle MFA enforcement through the relevant environment variable (e.g. the security/MFA env knob defined by your n8n version) and restart the instance.
2. If API control is required, unset the `securityPolicyManagedByEnv` flag in config so the API path is re-enabled.

// Expose securityPolicyManagedByEnv via /settings and gate the UI control.
if (settings.securityPolicyManagedByEnv) {
  disableMfaEnforceToggle('MFA enforcement is env-managed — set it via environment variable.');
  return;
}

When it happens

Trigger: POST /rest/mfa/enforce-mfa while `securityPolicyManagedByEnv` config flag is true.

Common situations: Enterprise/containerised deployment where security policies are pinned via env vars; helm/k8s chart sets the managed-by-env flag.

Related errors

• Reflector output did not contain a JSON object
• MCP server "${cfg.name}": exactly one of "url" or "command"
• MCP server "${cfg.name}": provide either "url" or "command",
• MCP server name "${cfg.name}" is already registered
• NODE_TYPE_NOT_FOUND

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/bbdf7cfdf1181ab4. Report an issue: GitHub.