n8n-io/n8n · error · ForbiddenError

Instance owner cannot be deleted.

Error message

Instance owner cannot be deleted.

What it means

Returned by DELETE /users/:id when the target user's role slug equals GLOBAL_OWNER_ROLE.slug. The instance owner is undeletable; this guard fires after the existence check and before the transferee logic. HTTP 403.

Solutions

1. Never include the global owner in deletion targets.
2. Transfer ownership to another user first via the documented ownership-transfer flow if you need to retire the current owner.
3. Filter the owner out of bulk operations by role.slug.

function excludeOwnerFromDeletes(users: Array<{id:string;roleSlug:string}>) {
  return users.filter((u) => u.roleSlug !== 'global:owner').map((u) => u.id);
}

const isOwnerRole = (slug: string) => slug === 'global:owner';

When it happens

Trigger: An admin or owner attempts DELETE /users/<owner-id>; the target row's role.slug is the global owner slug.

Common situations: Bulk-delete script iterating all users including the owner; UI showing a delete action on the owner row; attempting to remove the original setup account.

Related errors

• Admin cannot change role on global owner
• Admin cannot reset password of global owner
• Owner cannot change role on global owner
• Cannot change your own global role
• Instance roles are managed automatically and cannot be…

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/3326408986e4d2ee. Report an issue: GitHub.

Appendix: source

Thrown at packages/cli/src/controllers/users.controller.ts:249

			);
			throw new BadRequestError('Cannot delete your own user');
		}

		const { transferId } = req.query;

		const userToDelete = await this.userRepository.findOne({
			where: { id: idToDelete },
			relations: ['role'],
		});

		if (!userToDelete) {
			throw new NotFoundError(
				'Request to delete a user failed because the user to delete was not found in DB',
			);
		}

		if (userToDelete.role.slug === GLOBAL_OWNER_ROLE.slug) {
			throw new ForbiddenError('Instance owner cannot be deleted.');
		}

		const personalProjectToDelete = await this.projectRepository.getPersonalProjectForUserOrFail(
			userToDelete.id,
		);

		if (transferId === personalProjectToDelete.id) {
			throw new BadRequestError(
				'Request to delete a user failed because the user to delete and the transferee are the same user',
			);
		}

		let transfereeId;
		let transfereeProject: Project | null = null;

		if (transferId) {
			transfereeProject = await this.projectRepository.findOneBy({ id: transferId });

View on GitHub (pinned to 5ac6606e81)