n8n-io/n8n · error · ForbiddenError

Security settings are managed via environment variables and

Error message

Security settings are managed via environment variables and cannot be modified through the API

What it means

The instance is configured so security policy is controlled by environment variables (instanceSettingsLoaderConfig.securityPolicyManagedByEnv === true). Under that mode, writes to security settings via the API are blocked with 403 ForbiddenError, because the source of truth is the environment, not the database.

Source

Thrown at packages/cli/src/controllers/security-settings.controller.ts:47

		]);

		return {
			...settings,
			managedByEnv: this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv,
			...(workflowReviews !== undefined ? { workflowReviews } : {}),
		};
	}

	@Licensed('feat:personalSpacePolicy')
	@GlobalScope('securitySettings:manage')
	@Post('/')
	async updateSecuritySettings(
		req: AuthenticatedRequest,
		_res: Response,
		@Body dto: UpdateSecuritySettingsDto,
	) {
		if (this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv) {
			throw new ForbiddenError(
				'Security settings are managed via environment variables and cannot be modified through the API',
			);
		}

		if (dto.workflowReviews !== undefined) {
			this.assertWorkflowReviewsAvailable();
		}

		const updatedSettings: Partial<UpdateSecuritySettingsDto> =
			await this.securitySettingsService.updateSecuritySettings(
				{
					personalSpacePublishing: dto.personalSpacePublishing,
					personalSpaceSharing: dto.personalSpaceSharing,
					redactionEnforcement: dto.redactionEnforcement,
				},
				req.user,
			);

View on GitHub (pinned to 5ac6606e81)

Solutions

Change the relevant security env vars and restart the instance instead of using the API.
If API management is genuinely required, disable securityPolicyManagedByEnv in the configuration and restart.

Example fix

// before: trying to PATCH security settings via API while env-managed -> 403
// after: set policy via env and restart
// N8N_SECURITY_PERSONAL_SPACE_PUBLISHING=...
// then restart n8n; do not call POST /security-settings

Defensive patterns

Strategy: validation

Validate before calling

// Determine if security settings are env-managed before attempting writes.
function isSecurityPolicyEnvManaged(state) { return Boolean(state?.securityPolicyManagedByEnv); }

Try / catch

try {
  await api.post('/security-settings', dto);
} catch (e) {
  if (e.status === 403 && /managed via environment variables/.test(e.message)) {
    // stop calling the API; update env vars and restart instead
  } else { throw e; }
}

Prevention

Reflect env-managed mode in the UI by disabling the controls.
Keep security policy in version-controlled env config.

When it happens

Trigger: POST /security-settings (updateSecuritySettings) when the instance was started with securityPolicyManagedByEnv enabled.

Common situations: Hardened/enterprise deployment where policy is pinned via env to prevent runtime drift; GitOps/env-managed config; admin tries the UI/API toggle and it is intentionally disabled.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/00e33a5caf2dcccc. Report an issue: GitHub.