Agent skill · software engineering · n8n-io
n8n:protect-endpoints
Applies n8n's RBAC scope decorators to REST endpoints. Use when creating a new @RestController, adding any @Get/@Post/@Put/@Patch/@Delete route to an existing controller, or reviewing endpoint authorization. Every authenticated endpoint must be gated by @ProjectScope or @GlobalScope.
Why this skill is useful
Adds specific RBAC scope decorators and conventions for securing REST endpoints that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 199,638 stars on the source repository.
What this skill does
Protect REST endpoints with RBAC Rule: every authenticated route on a @RestController MUST carry an access-scope decorator. If you add a route without one, the IDOR/permission bypass is on you. Decision @ProjectScope succeeds if the user has the scope globally OR in the project named in the URL. @GlobalScope ignores project relations entirely. Both decorators come from @n8n/decorators. The middleware lives in packages/cli/src/controller.registry.ts (createScopedMiddleware) and resolves access via userHasScopes in packages/cli/src/permissions.ee/check-access.ts. Apply the decorator Conventions: One decorator per route, placed directly under the HTTP-method decorator. Use the most specific scope that fits. Reuse :update for state-changing actions like publish/unpublish/build unless the resource needs to gate them separately (see workflow:publish for the precedent). Routes without :projectId and not global-only operations are usually a design smell — flag it. When the scope doesn't exist yet Add the resource and ops in packages/@n8n/permissions/: 1. src/constants.ee.ts — add to RESOURCES (alphabetical): The Scope union (<resource>:<op> template-literal type) auto-derives. 2. src/scope-information.ts — add a display name + description per scope. 3. src/roles/scopes/project-scopes.ee.ts — add to project roles. Match the workflow precedent unless product says otherwise: REGULARPROJECTADMINSCOPES, PERSONALPROJECTOWNERSCOPES, PROJECTEDITORSCOPES → all CRUDL+execute scopes. PROJECTVIEWERSCOPES → read/list/execute only. PROJECTCHATUSERSCOPES → execute only (if applicable). 4. src/roles/scopes/global-scopes.ee.ts — add to GLOBALOWNERSCOPES (admin inherits via concat()). Do not add to member/chat-user globals — they get scopes via project relations. 5. Personal-space publishing: if you add a <resource>:publish scope, also append it to PERSONALSPACEPUBLISHINGSETTING.scopes in constants.ee.ts so personal-owner gating matches workflow:publish. 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills n8n-io/protect-endpoints