n8n-io/n8n · error · SecurityError

Method '${methodName}' is not an allowed SDK method. Allowed

Error message

Method '${methodName}' is not an allowed SDK method. Allowed methods: ${allowedMethodNames().join(', ')}. Native array/string methods are not available in SDK code; use a Code node or an n8n expression for runtime logic.

What it means

Method calls on objects are restricted to the `ALLOWED_METHODS` set: `add`, `to`, `group`, `input`, `output`, `onError`, `onTrue`, `onFalse`, `onCase`, `onEachBatch`, `onDone`, `connect`, `toJSON`, `validate`. Native JavaScript methods (`.push()`, `.map()`, `.filter()`, `.split()`, `.join()`, etc.) are not available. The only exceptions are `JSON.stringify` and two string methods (`.repeat()`, `.trim()`) which have dedicated safe wrappers checked before the allowlist.

Source

Thrown at packages/@n8n/workflow-sdk/src/ast-interpreter/interpreter.ts:273

				const safeMethod = getSafeJSONMethod(memberExpr.object.name, methodName);
				if (safeMethod) {
					const args = node.arguments.map((arg) => this.evaluate(arg));
					return safeMethod(...args);
				}
			}

			thisArg = this.evaluate(memberExpr.object);

			// Handle safe string methods (e.g. "abc".repeat(3))
			const safeStringMethod = getSafeStringMethod(thisArg, methodName);
			if (safeStringMethod) {
				const args = node.arguments.map((arg) => this.evaluate(arg));
				return safeStringMethod(...args);
			}

			// Validate method name against allowlist
			if (!isAllowedMethod(methodName)) {
				throw new SecurityError(
					methodName,
					memberExpr.property.loc ?? undefined,
					this.sourceCode,
					`Method '${methodName}' is not an allowed SDK method. ` +
						`Allowed methods: ${allowedMethodNames().join(', ')}. ` +
						'Native array/string methods are not available in SDK code; ' +
						'use a Code node or an n8n expression for runtime logic.',
				);
			}

			if (thisArg && typeof thisArg === 'object') {
				func = (thisArg as Record<string, unknown>)[methodName];
			}
		} else {
			throw new UnsupportedNodeError(
				`Callee type ${node.callee.type}`,
				node.callee.loc ?? undefined,
				this.sourceCode,

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Use only SDK builder methods (`add`, `to`, `group`, `input`, `output`, `connect`, etc.)
2. For JSON: use `JSON.stringify()` — it is the only allowed JSON method (parse is not available)
3. For strings: use `.repeat()` or `.trim()` — the only allowed string methods
4. For any other data transformation (map, filter, split, join, sort): move it to a Code node or an n8n expression

Example fix

// before
const names = items.map((i) => i.name);

// after
// (array methods are not available in SDK code — move to a Code node)
// In SDK code, build structures with SDK functions instead:
const wf = workflow({ name: 'X' });
wf.add({ name: items[0].name });

import { ALLOWED_METHODS } from '@n8n/workflow-sdk/ast-interpreter/validators';

const SAFE_JSON = new Set(['stringify']);
const SAFE_STRING = new Set(['repeat', 'trim']);

function findDisallowedMethods(code: string): string[] {
  const ast = parse(code, { ecmaVersion: 'latest', sourceType: 'module' });
  const bad: string[] = [];
  walk(ast, (node) => {
    if (node.type === 'CallExpression' && node.callee.type === 'MemberExpression') {
      const prop = node.callee.property;
      const name = prop.type === 'Identifier' ? prop.name : null;
      if (name && !ALLOWED_METHODS.has(name) && !SAFE_JSON.has(name) && !SAFE_STRING.has(name)) {
        bad.push(name);
      }
    }
  });
  return bad;
}

import { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';

try {
  interpretSDKCode(sdkCode, sdkFunctions);
} catch (e) {
  if (e instanceof SecurityError && e.message.includes('not an allowed SDK method')) {
    // show the allowed method list and suggest a Code node for data transformation
  }
  throw e;
}

When it happens

Trigger: Calling `items.push(x)`, `text.split(',')`, `arr.map(fn)`, `obj.keys()`, or any native method. At interpreter.ts:264-282, the interpreter first checks `getSafeStringMethod` (for `.repeat`/`.trim` on strings), then `isAllowedMethod`. If neither matches, it throws `SecurityError`.

Common situations: Trying to manipulate arrays or strings in SDK code (the most common porting mistake); expecting standard JS collection methods; data transformation logic that belongs in a Code node.

Related errors

• '${name}' is a reserved SDK function name and cannot be used
• Unsupported syntax: 'Dynamic method name' is not allowed in
• Unsupported syntax: 'Dynamic property access' is not allowed
• Unsupported syntax: 'Object key type ${prop.key.type}' is no
• LangSmithTelemetry creates its own tracer — do not use .otlp

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/d7451b251ba9ebf0. Report an issue: GitHub.