n8n-io/n8n · error · UserError

You must use exactly one of `--userId`, `--projectId` or `--

Error message

You must use exactly one of `--userId`, `--projectId` or `--deleteWorkflowsAndCredentials`.

What it means

Thrown by the `ldap:reset` CLI command when the number of mutually-exclusive migration flags is not exactly one. The command requires precisely one of `--userId`, `--projectId`, or `--deleteWorkflowsAndCredentials` because each implies a different post-LDAP-reset cleanup strategy (reassign to a user, reassign to a project, or hard-delete). It is a UserError, meaning the operator's invocation caused it, not a system fault.

Source

Thrown at packages/cli/src/commands/ldap/reset.ts:70

	description:
		'Resets the database to the default ldap state.\n\nTHIS DELETES ALL LDAP MANAGED USERS.',
	examples: [
		'--userId=1d64c3d2-85fe-4a83-a649-e446b07b3aae',
		'--projectId=Ox8O54VQrmBrb4qL',
		'--deleteWorkflowsAndCredentials',
	],
	flagsSchema,
})
export class Reset extends BaseCommand<z.infer<typeof flagsSchema>> {
	async run(): Promise<void> {
		const { flags } = this;
		const numberOfOptions =
			Number(!!flags.userId) +
			Number(!!flags.projectId) +
			Number(!!flags.deleteWorkflowsAndCredentials);

		if (numberOfOptions !== 1) {
			throw new UserError(wrongFlagsError);
		}

		const owner = await this.getOwner();
		const ldapIdentities = await Container.get(AuthIdentityRepository).find({
			where: { providerType: 'ldap' },
			select: ['userId'],
		});
		const personalProjectIds = await Container.get(
			ProjectRelationRepository,
		).getPersonalProjectsForUsers(ldapIdentities.map((i) => i.userId));

		// Migrate all workflows and credentials to another project.
		if (flags.projectId ?? flags.userId) {
			if (flags.userId && ldapIdentities.some((i) => i.userId === flags.userId)) {
				throw new UserError(
					`Can't migrate workflows and credentials to the user with the ID ${flags.userId}. That user was created via LDAP and will be deleted as well.`,
				);
			}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Run `n8n ldap:reset --help` and pick exactly one of the three flags.
2. If you want to keep the orphaned workflows/credentials, choose `--userId` or `--projectId` pointing at a non-LDAP target; otherwise use `--deleteWorkflowsAndCredentials`.
3. Audit any wrapper script to ensure it always passes exactly one flag and fails loudly otherwise.

Example fix

// before
n8n ldap:reset --userId=ABC --projectId=XYZ
// after
n8n ldap:reset --projectId=XYZ

const flags = { userId, projectId, deleteWorkflowsAndCredentials };
const count = Number(!!flags.userId) + Number(!!flags.projectId) + Number(!!flags.deleteWorkflowsAndCredentials);
if (count !== 1) {
  throw new Error('Pass exactly one of --userId, --projectId, or --deleteWorkflowsAndCredentials');
}

When it happens

Trigger: Running `n8n ldap:reset` with zero flags, with two or three flags together (e.g. `--userId=X --projectId=Y`), or relying on a default that does not exist. The check sums `Number(!!flags.userId) + Number(!!flags.projectId) + Number(!!flags.deleteWorkflowsAndCredentials)` and compares to 1.

Common situations: Operators running the LDAP reset without reading the help text; copy-pasting a command template that already contained two flags; scripting the reset and forgetting to pass a flag in one code path.

Related errors

• Can't migrate workflows and credentials to the user with the
• Can't migrate workflows and credentials to the project with
• Could not find the project with the ID ${projectId}.
• Could not find the user with the ID ${userId} or their perso
• Failed to find owner. ${UM_FIX_INSTRUCTION}

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/cc2ca8289cabbdb0. Report an issue: GitHub.