n8n-io/n8n · error · UserError

Invalid categor${invalidCategories.length > 1 ? 'ies' : 'y'}

Error message

Invalid categor${invalidCategories.length > 1 ? 'ies' : 'y'} received: ${invalidCategories.join(', ')}. Valid categories are: ${RISK_CATEGORIES.join(', ')}

What it means

The `n8n audit` command throws UserError when one or more --categories values are not in RISK_CATEGORIES. The message lists the invalid categories and the valid set, joined with '. '. Stops the audit before invoking SecurityAuditService.

Source

Thrown at packages/cli/src/commands/audit.ts:71

	}

	async run() {
		const { flags: auditFlags } = this;
		const categories =
			auditFlags.categories?.split(',').filter((c): c is Risk.Category => c !== '') ??
			RISK_CATEGORIES;

		const invalidCategories = categories.filter((c) => !RISK_CATEGORIES.includes(c));

		if (invalidCategories.length > 0) {
			const message =
				invalidCategories.length > 1
					? `Invalid categories received: ${invalidCategories.join(', ')}`
					: `Invalid category received: ${invalidCategories[0]}`;

			const hint = `Valid categories are: ${RISK_CATEGORIES.join(', ')}`;

			throw new UserError([message, hint].join('. '));
		}

		const { SecurityAuditService } = await import('@/security-audit/security-audit.service.js');

		const result = await Container.get(SecurityAuditService).run(
			categories,
			auditFlags['days-abandoned-workflow'],
		);

		if (Array.isArray(result) && result.length === 0) {
			this.logger.info('No security issues found');
		} else {
			process.stdout.write(JSON.stringify(result, null, 2));
		}
	}

	async catch(error: Error) {
		this.logger.error('Failed to generate security audit');

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Run `n8n audit --help` (or check RISK_CATEGORIES in source) and pass only valid categories.
2. Omit --categories to run the default audit set.
3. Upgrade/downgrade align expectations: confirm the supported category list for your n8n version.

Example fix

# before
n8n audit --categories=database,credentials

# after (use valid category names)
n8n audit --categories=credentials,_nodes,filesystem

import { RISK_CATEGORIES } from '@/commands/audit'; // or hardcode the valid set
const valid = categories.filter((c) => RISK_CATEGORIES.includes(c));
if (valid.length !== categories.length) { /* reject before running audit */ }

function isInvalidCategoryError(error: unknown): boolean {
  return error instanceof Error && error.message.startsWith('Invalid categor');
}

try {
  await Audit.run(argv);
} catch (e) {
  if (isInvalidCategoryError(e)) { /* show valid categories from message and re-invoke */ }
  else throw e;
}

When it happens

Trigger: Running `n8n audit --categories=<x>` where <x> (or one of a comma list) is not a member of RISK_CATEGORIES (e.g. typo like 'database' instead of the supported key).

Common situations: Typo in the category name; using a category from an older/newer n8n version; copy-pasted command with a stale category list.

Related errors

• Provider connection data cannot be empty
• Provider connection data must be a JSON object
• File does not seem to contain credentials. Make sure the cre
• ${flagName} must contain at least one property name.
• No importable properties found. Please check the --include f

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/13da999f731cdfa9. Report an issue: GitHub.