phacility/phabricator · warning · PhutilArgumentUsageException

This account ("%s") can not establish web sessions, so it is

Error message

This account ("%s") can not establish web sessions, so it is not possible to generate a functional recovery link. Special accounts like daemons and mailing lists can not log in via the web UI.

What it means

The account exists but canEstablishWebSessions() is false: special accounts such as daemons, mailing lists, and system agents can never log in through the web UI, so a one-time login URI would not work. The workflow refuses to mint a useless recovery link rather than hand the admin a link that cannot be used.

Source

Thrown at src/applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php:53

        pht('You can only recover the username for one account.'));
    }

    $username = head($usernames);

    $user = id(new PhabricatorPeopleQuery())
      ->setViewer($this->getViewer())
      ->withUsernames(array($username))
      ->executeOne();

    if (!$user) {
      throw new PhutilArgumentUsageException(
        pht(
          'No such user "%s" to recover.',
          $username));
    }

    if (!$user->canEstablishWebSessions()) {
      throw new PhutilArgumentUsageException(
        pht(
          'This account ("%s") can not establish web sessions, so it is '.
          'not possible to generate a functional recovery link. Special '.
          'accounts like daemons and mailing lists can not log in via the '.
          'web UI.',
          $username));
    }

    $force_full_session = $args->getArg('force-full-session');

    $engine = new PhabricatorAuthSessionEngine();
    $onetime_uri = $engine->getOneTimeLoginURI(
      $user,
      null,
      PhabricatorAuthSessionEngine::ONETIME_RECOVER,
      $force_full_session);

    $console = PhutilConsole::getConsole();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Recover a real human account — system accounts never need web recovery.
2. If this is a legitimate user who cannot log in, review the account's roles/type under People > Manage (e.g. system agent flag) and correct them.
3. For programmatic access by bots, use Conduit API tokens instead of web sessions.

// Verify before invoking the workflow.
if (!$user->canEstablishWebSessions()) {
  // skip recovery with a clear message; system/bot accounts cannot use
  // one-time login links
}

When it happens

Trigger: Running './bin/auth recover daemon' (or any system/bot/mailing-list account); recovering an account whose roles/type forbid web sessions.

Common situations: Trying to recover bot or service accounts out of habit; testing the recovery tool against an obvious account name that happens to be a system account.

Related errors

• You must specify the username of the account to recover.
• You can only recover the username for one account.
• No such user "%s" to recover.
• Request parameter "%s" is not formatted properly. Expected a
• Request parameter "%s" is not formatted properly. Expected a

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/059f17e5e3db973c. Report an issue: GitHub.