ActiveModel::ForbiddenAttributesError (strong parameters) Ruby / Rails Origin: Application & API OSI layer 7 · Application Last updated 5 Nov 2026

Rails: ActiveModel::ForbiddenAttributesError

You passed raw params to new/create/update, but strong parameters require permitting attributes first.

Exact message you may see ActiveModel::ForbiddenAttributesError (ActiveModel::ForbiddenAttributesError)ForbiddenAttributesError strong parametersUnpermitted parameter: :nameActiveModel::ForbiddenAttributesError in UsersController#create
Explore the map of this error Full error map →
Seen on: Ruby

Meaning

Use params.require(:user).permit(:name, :email) (a private user_params method), then User.create(user_params). params.to_unsafe_h bypasses protection — avoid it. In APIs with JSON make sure the root key matches require.

Common causes

  • User.new(params[:user]) without permit
  • Permitted list missing a nested hash/array (permit(tags: []))
  • Using params instead of user_params in update
  • Root key mismatch (wrap_parameters)
  • Upgrade from Rails 3 attr_accessible

⚡ Quick fix

  1. def user_params; params.require(:user).permit(:name, :email); end
  2. Use User.create(user_params)
  3. Permit nested: permit(:name, address: [:street, :city], tag_ids: [])

Detailed fix by platform

Rails

  1. params.require(:post).permit(:title, :body, tag_ids: [])

How to diagnose

  1. Call — Uses permitted params?
  2. Nested — Permitted?
  3. Root — Correct key?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

"x" can't be opened because it is from an unidentified developer — macOS: “app” can’t be opened because it is from an unidentified developer (macOS)"x" can't be opened b…ActionController::ParameterMissing: param is missing or the value is empty — Rails: ActionController::ParameterMissing: param is missing or the value is empty: user (Ruby / Rails)ActionController::Par…ActiveRecord::AssociationTypeMismatch — Rails: ActiveRecord::AssociationTypeMismatch: User(#1234) expected, got "42" which is an instance of String(#5678) (Ruby / Rails)ActiveRecord::Associa…ActiveRecord::ConnectionNotEstablished — Rails: ActiveRecord::ConnectionNotEstablished: No connection pool for 'ActiveRecord::Base' found (Ruby / Rails)ActiveRecord::Connect…ActiveRecord::Deadlocked: PG::TRDeadlockDetected — Rails: ActiveRecord::Deadlocked: PG::TRDeadlockDetected: ERROR: deadlock detected (Ruby / Rails)ActiveRecord::Deadloc…ActiveRecord::IrreversibleMigration — Rails: ActiveRecord::IrreversibleMigration — This migration uses remove_column without a type; db:rollback can't reverse it (Ruby / Rails)ActiveRecord::Irrever…ActiveRecord::RecordInvalid: Validation failed — Rails: ActiveRecord::RecordInvalid: Validation failed: Email can't be blank, Name is too short (Ruby / Rails)ActiveRecord::RecordI…Apple could not verify "x" is free of malware — macOS: “app” cannot be opened because Apple cannot check it for malicious software / Apple could not verify “app” is free of malware that may harm your Mac (macOS)Apple could not verif…ActiveMod…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.