Deprecated Parameters

This document outlines the parameters deprecated in Rocket.Chat’s REST API endpoints and Realtime API methods. Some of these parameters have already been removed, while others are scheduled for removal in upcoming releases. To ensure continued functionality, adopt the recommended alternatives specified for each affected parameter.

REST API

The table below shows the deprecated parameters in our REST API endpoints:

Parameter	Endpoints affected	Release deprecated	Release removal	Description
`role`	roles.getUsersInRole	4.6.0	7.0.0	This parameter will no longer accept `roleName` as a fallback. Use only `roleId` instead.
`roleName`	roles.addUserToRole	4.6.0	7.0.0	This parameter will no longer be accepted. Use `roleId` instead.
`roleName`	roles.removeUserFromRole	4.6.0	7.0.0	This parameter will no longer be accepted. Use `roleId` instead.
`appId`	oauth-apps.get	6.0.0	7.0.0	The parameter will stop being accepted (use the `clientId` or `_id` parameters instead).

Query and fields query parameters

The query and fields parameters have been deprecated since version 5.0.0 across all supported endpoints to prevent malicious queries. They are disabled by default from version 7.0.0 and can only be enabled by setting the ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS: true environment variable in your deployment configuration.

Enabling these parameters may expose your workspace to security risks, and Rocket.Chat is not responsible for any resulting vulnerabilities. Proceed with caution and ensure proper security measures are in place.

When enabled, a deprecation message is included in the response header as X-Deprecation-Message. These parameters are scheduled for removal in version 8.0.0, after which enabling them will no longer be an option.

The following endpoints are among those affected:

Endpoint	`query` parameter	`fields` parameter
settings.public	✓	✓
statistics.list	✓	✓
custom-sounds.list	✓	✓
emoji-custom.list	✓	x
integrations.history	✓	✓
integrations.list	✓	✓
users.list	✓	✓
users.info	x	✓
chat.getThreadsList	✓	✓
chat.getThreadMessages	✓	✓
im.files	✓	✓
im.list.everyone	✓	✓
im.messages	✓	✓
im.messages.others	✓	✓
email-inbox.list	✓	✓
spotlight	✓	x
omnichannel/agents/available	✓	x
livechat/rooms (GET)	x	✓
canned-responses (GET)	x	✓
voip/rooms	x	✓
channels.anonymousread	✓	✓
channels.files	✓	✓
channels.list.joined	✓	✓
channels.list	✓	✓
channels.messages	✓	x
channels.getIntegrations	✓	✓
rooms.getDiscussions	✓	✓
teams.list	✓	x
groups.online	✓	x
groups.getIntegrations	✓	✓
groups.listAll	✓	✓
groups.messages	✓	✓
groups.files	✓	✓
channels.online	✓	x
directory	✓	✓
rooms.info	x	✓
dm.messages	✓	✓
custom-user-status.list	✓	x

Realtime API

The table below outlines the deprecated parameters in our Realtime API methods:

Method	Parameters affected	Release deprecated	Release removal	Description
`apps (POST)`	`downloadOnly`	6.6.0	7.0.0	The parameter will stop being accepted.
`authorization:removeUserFromRole`	`role`	4.6.0	7.0.0	This parameter will no longer accept `roleName` as a fallback. Use only `roleId` instead.
`authorization:deleteRole`	`role`	4.6.0	7.0.0	This parameter will no longer accept `roleName` as a fallback. Use only `roleId` instead.
`authorization:addUserToRole`	`role`	4.6.0	7.0.0	This parameter will no longer accept `roleName` as a fallback. Use only `roleId` instead.