Security

About half a year go we set up a API Token thats being used by an external Web Application which triggers jobs on our FME Flow environment. This worked all fine till we upgraded to 2026.2 this summer.The right's we had set up were:Jobs AccessRecources Access (only to the required resources folder)Run Workspace AccessSince the upgrade to 2026.2 nothing was changed by us in these settings. The web application can still start jobs as needed. But any request of GET /jobs/{id} , /jobs/{id}/result en /jobs/{id}/log gives a 403 error now. The only way i found around it is to give the API Token the Jobs Manage permisson.But this feels wrong to me. If i read the documentation this would give the token access to all users jobs instead of only the ones started through this API Token. I can't find any mention about changes concerning this (only about the Tokens for FME Flow Apps which we are not using). Anybody has any idea what could be the cause here? Am i overlooking something?

Hi there,We are updating our connections to ArcGIS Online through FME Flow to use OAuth as much as possible.I have created an OAuth Web Connection and Web Service for each of the ArcGIS Online orgs we want to connect to from Flow.My question is, if we need to connect to one of these orgs with multiple users, do we need a different specific web connection for each user pointing at the same web service?Thanks,Marc

I'd like to retrieve running job details using the API. I use GET /jobs/{id} for this. This works perfectly when I assign ‘all permissions’ to the API-token. But when I try to make the scope more specific by setting the access right to Jobs-->Access, I'm not able to see the job details anymore. What are the minimal rights to make this possible?I also assigned rights to a single repository and resource, but this is not visible on the screnshot. 

Since upgrading from FME Flow 2025.2 to 2026.2, we are seeing a recurring authentication problem with our Workspace Apps. When a user opens or reloads an app, a native browser Basic Authentication popup appears intermittently, roughly every second or third load. Because we use SAML, our users have no local username or password to enter and are forced to click Cancel every time. After cancelling, the app works normally, but the repeated prompt is disruptive for end users.Our setup: FME Flow runs under HTTP behind an IIS reverse proxy (Application Request Routing) that enforces HTTPS. Authentication is handled through SAML with Azure AD as the identity provider using SP initiated login. On IIS, only Anonymous Authentication is enabled while Windows and Basic Authentication are disabled, and the SAML base URL is correctly configured.Using the browser developer tools, I captured the exact request that returns the 401. It is a GET to the Data Upload Service that the app fires in the backgro

Like the title says, whenever I try to publish a workspace with a sharepoint connector webservice to fme flow, I get below message. I have no problem writing to the same repository if I don't have sharepoint connector webservice in my workspace. Moreover I have no problem using the sharepoint connector webservice local on my fme form. Does anyone might have ideas why I get this error when trying to publish the sharepoint connector webservice to fme flow? 

I need to change the ownership of some workspace apps to another user. The reason is that the user has left the company, the user does not exist in EntraID anymore and the ownership has to be transfered to another user.Through the UI I cannot alter the ownership, so I have been trying to do it through REST.using {{baseUrl}}/fmeapiv4/apps/workspaces/{{appId}}I can execute a PUT with adjustments to “owner” and “ownerID”. The request executes with code 204 (No Content).However, a subsequent GET request using the same url as I used for the PUT request returns the data for the app untouched and the old owner remains. So does the ownerID.Is there any possibility for me to transfer ownership of a workspace app to another user?

I understand there are 4 cadence releases per year, for example 2026.1.0 and then 2026.2 through to 2026.4 by the year end.2026.1 is the first release of 2026. Instead of starting at xxxx.0, it starts at xxxx.12026.2.0 (Major) 2026.2.1 (Update) 2026.2.2 (Update) 2026.3.0 (Major) 2026.3.1 (Update) 2026.3.2 (Update) 2026.4.0 (Major) 2026.4.1 (Update) 2026.4.2 (Update) My question is to a Safer is not about the major releases, rather regarding these updates.Can you simply install as a patch over the existing major, or is it a full install, 2026.1.2 sure appears to be full install media?Where is the documentation for installing patch hot fix to the existing flow installation directory? 

Hello, We recently updated FME-flow to 2025.2.4. Shortly after we’re not able to publish workspaces from FME-form (2025.2) to Flow with the message ‘User is not authorized.’ while I use a superuser account. I cannot find something related in the User Management section on FME-form. Or might it also be something related on the server it is installed?If someone has tips or knows more about this issue that would be greatly appreciated.  

Hello Community,I am struggling with FMEFlowJobSubmitter transformer in FME 2026 and am leaning on the community to help me figure the problem out.I have a workspace that runs a child workspace using WorkspaceRunner locally or FMEFlowJobSubmitter on FME Flow. It worked perfectly well on FME 2024.1. Recently, we upgraded to 2026.1 and the workspace started failing on FME Flow. It looks like the workspace fails to run the child workspace.Now, when I open my main workspace with 2026.1 FME Form and get to FMEFlowJobSubmitter parameters, I get an error message in the log:This is the whole experience:What I’ve checked/done so far:Both, FMEFlowJobSubmitter from 2024 and FMEFlowJobSubmitter from 2026, throw the same error in 2026 FME Form. I am fmesuperuser and fmeadmin, i.e. my privileges are quite extensive. Users were restored from backup after FME Flow upgrade, so technically there should be no changes in access privileges I checked Items and didn’t find anything that would feel related to

I am logging in  FME FLOW on our local FME Server (v25.2.1) using my AD Credentials that I manually enter.  When I get logged in, I try to open several workbenches that I had previously uploaded and to which I had full access. However, I get a popup message “Unauthorized request by user (myaccountname) due to lack of proper permissions or the object does not exist.”I contacted the local FME administrator who advised that my account had full permissions to the workbenches I was trying to access.  He advised I log off and back in several times, the implication that he was reviewing or changing something on his end.  And always the same resulting error message.The administrator is adamant that I should be able to access the workbenches, however, I cannot.I had asked that the issue be escalated but the administrator was unsure where to escalate the issue.I am looking for any advice on the issue.Thanks in advance

Hello!After an update from FME-flow 2024 to 2025 and after the update some roles are not able to open the repositories under workspaces. They get the message ‘Unauthorized request by user <user> due to lack of proper permissions or the object does not exist’. I'm a superuser and able to open the repositories. Is there a new option under User Management I'm not aware of? Or does someone know a solution?

Hi there,In this article (Configure user attribute mapping with Azure AD SAML Provider – FME Support Center), a group claim can be setup to pass an AD group name which aligns to a role in FME Flow. As a group claim could be based on a search criterion and many AD groups could be returned which is a common method of Enterprise group membership in ArcGIS Enterprise software. I was wondering if this could be used to grant several roles to a user?Looking at controlling access to repositories, who can view workspace and who can run a job, etc via AD group assignment.Thanks

Good afternoon fellow FME enthousiasts,I'm struggling with the following. I'm trying to set up the System Email settings on our FME Flow to allow users to request a password reset. It all seems pretty straightforward but can't get it to work. Maybe i'm missing something though (it is friday afternoon after all). I've set it up as follows: But when i validate it I get the error:“Due to a configuration change made by your administrator or because you moved to a new location you must use multi factor authentication to access…...” Emails through emailers in workspaces ran on flow work like a charm, but this one keeps evading me. Any help would be appreciated.

HiWe are currently using FME Server 2021.2.1 on one of our servers, and we have identified a security vulnerability in this version. We would like to know if there are any available patches to resolve this issue. Please note that our ArcGIS Enterprise version is 10.9.1. We are concerned that upgrading FME Server to a newer version may cause compatibility issues with our current ArcGIS environment. Could someone please advise on the best way to solve this issue?

Hi,In articles such as this: https://support.safe.com/hc/en-us/articles/25407440139533-How-to-Create-a-SharePoint-Single-Tenant-Web-Connection-for-FME-Flow the workflow for publishing web connections with delegated permissions is to upload to Flow, and then modify the underlying Web Service. However, if FME Flow is set to be the connection storage, then that Web Service will be modified for Form as well as Flow.I am wondering how to manage this? Should I create two web services and web connections and upload both to Flow, then edit the Flow version to include the client secret? Then we would need to develop the workspace in Form using the Form specific connection, and then switch to the Flow version before publishing?It would be good to get some guidance on best practice for this.Thanks,Marc

 Since using FME Flow version 2024.2.3, running on Windows Server 2022. we face the following issues.BackgroundWe found that in FME Flow 2024.2.3 the network security protocol TLS1.3 is not configured by default. We expect it to work, see e.g. FME Community TLSv1.3 Support).  Also, for TLSv1.3, the minimum requirements for the versions of OpenSSL and Java used are:Tomcat 9.0.13 and later versions have built-in TLS 1.3 support For TLS 1.3 support, you need JDK 1.8.0_170 or later.As FME Support Third Party Component Versions reports, FME Flow 2024.2.3 uses Tomcat 9.0.91 and Java JDK 17.0.12+7.Actions First step: We enabled TLSv1.3 on our Server, by including the following keys in the Windows Registry: Windows Registry Editor Version 5.00 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server "Enabled"=dword:00000001 "DisabledByDefa

Hi all, I’m trying to connect to an SFTP operated by one of our vendors with an Automation Action but when trying to connect it just gives me an ‘Algorithm negotiation failed’ error with no other output.This page (FME Flow Troubleshooting: Automations – FME Support Center) says it’s an issue with the key exchange or host key algorithms not matching. They seem to have overlapping algorithms but I’m not sure how to definitively check what FME is using. Anyone had this issue? 

Apparently since fixing this problem https://support.safe.com/hc/en-us/articles/25407612007949-Known-Issue-FME-Flow-Apache-Tomcat-Vulnerability-with-X-Frame-Options-headerIn FME Flow 2025.1, embedding FME Flow content to other pages is disabled entirely by default.  Is there any chance to allow embedding from known sources or is embedding considered so risky that this would not be even considered? 

I just had to downgrade a local testing FME Flow (from 2025.2 to 2025.1.2) to solve some unforeseen breaking changes in 2025.2 (or probably in 2025.1.3).But now I cannot install a backups from 2025.2 into the 2025.1.2 Flow:I’m very sure that the backups does not contain anything that’s not workable in 2025.1.2, so it’s just a matter of administratively blocking the restore.Why is this versioning stonewalling necessary at all ?Why not just warn about potential problems and restore what can be restored ?

Hello,Our FME Flow server is installed behind a secure proxy and is accessible via the following URL: **[https://my.domaine.be](https://my.domaine.be)**The FME Flow server itself is *not* running in HTTPS; the HTTPS layer is configured at the proxy level.However, in the FME Flow configuration through the Web interface (Admin → System Configuration → Network & Email → Services), we have properly updated all URLs so that the root is **[https://my.domaine.be/](https://my.domaine.be/)**, and in “standard” usage everything works correctly with HTTPS URLs (access to the FME Flow web interface, data downloads, application publication, Webhook exposure).However, we are unable to use the REST API because an issue remains (see image in this email):FME seems to expect its API to be contacted over HTTP (see image in this email), whereas we must absolutely communicate with **my.domaine.be** over HTTPS.Could you tell us what needs to be adjusted in our configuration—whether at the proxy level (s

I’m working with FME Flow 2025 and I’ve built a Flow App that allows users to run a workspace by clicking a “Run” button.My concern is about system overload: if a user (maliciously or accidentally) clicks the “Run” button hundreds or thousands of times, this could flood the job queue and potentially saturate the single engine I have available.I’ve looked into Job Queues and Job Routing Rules, but they only let me set priorities and routing conditions (repository). I understand that jobs can be routed to different engines using queues, but that’s not my goal. My goal is to limit the number of jobs submitted by users, not to distribute them across multiple engines.What I’m trying to achieve is: Prevent users from creating an infinite queue of jobs. Ideally, enforce a limit per user (e.g., max 5 jobs active or queued). Any ideas?

Hi,I’m using the FME Server API to perform an audit and cleanup. I can use the API to retrieve lists of users, workspaces, and workbenches. Separately, I can also get a list of connections.I want to check if any of these connections are now redundant after the recent cleanup. Is there a way to link connection names to the workbenches they are used in, so I can identify and remove unused connections?I can’t see a way to do this via the API. The only approach I can think of is to download all the .fmw files and then read them in FME Desktop using the .fmw reader.Any help or alternative suggestions would be appreciated, ideally all within the api.Thanks!!

Hi,I have a unique situation where my org can’t connect to Flow from Form desktop.Some background first.We are hosting our own server with Flow 2025.0, and Form to match.For several months now we have been using Microsoft Azure to login to Flow, and to also connect via Form using the same authentication method.  The Azure login to Flow via the web GUI still works without any issue.  Visiting the Manage Web Services options, the web service that was built using the MS Azure Active Directory template authenticates fine using the “Test” option so proper communication is occurring between the Microsoft tenant and our Flow server.Our IT department recently upgraded the GIS team to Windows 11 and since then we’ve experienced problems.Within Form, using the admin account with a password still works and we can carry on publishing.However, trying to connect via Azure is giving us fits.   Any attempt to create a new connection to Flow results in the following error message - “Request to update a

I see a description of the FME_SERVER_WEB_URL in documentation. Question: What does it do? With a setup that has a proxy server that relays requests to the FME Flow server via URL ReWrite and ARR, a flawed web-hook request (e.g., a parameter name address is given to a web hook that doesn’t have an address parameter) causes an error message to be returned to client--with details such as the internal server name (as set by FME_SERVER_WEB_URL, which is set to the internal server out-of-the-box) and the FME Flow username of user who published workspace. I understand changing service URLs for this sort of setup; that seems to be how the client knows how to download/stream the result. But FME_SERVER_WEB_URL seems to be more for just info provision (logging, etc.). What if I don’t want the FME_SERVER_WEB_URL parameter to show the internal server name in error messages from bad web-hook requests?