Secure MongoDB API Endpoint with Input Validation - n8n Workflow

Backend developers needing rapid, secure internal APIs.
DevOps professionals automating secure data lookups.
Users looking for advanced n8n templates that handle flow control and security.
Anyone needing robust input validation and custom transformation within an n8n workflow.

This robust n8n workflow template solves the common problem of safely exposing backend database access via a public API. It utilizes a powerful n8n trigger (the Webhook n8n node) to accept a collection name dynamically from the URL path. Before executing any database operation, a critical validation step (using a Code n8n node) ensures the collection name adheres to strict security rules, preventing malicious queries or unauthorized access to reserved MongoDB collections.

This structure provides a highly secure and reliable foundation for building data retrieval services using n8n. If you are searching for secure n8n templates, this flow demonstrates best practices for data handling, error reporting, and validation within any complex n8n node sequence. The entire operation is managed through carefully configured n8n nodes, ensuring efficiency and security.

The process begins when the n8n trigger, configured as a Webhook n8n node, receives an HTTP GET request containing the target MongoDB collection name in the URL path.

1. Input Capture: The Webhook n8n trigger captures the :nameCollection path parameter.


2. Collection Validation: The Validate Pattern Code n8n node applies a strict regex rule to the collection name, verifying that it is safe, valid, and not reserved. This crucial n8n node outputs a valid: true or valid: false flag.


3. Conditional Routing: The If n8n node checks the validation result produced by the previous n8n node.


4. Error Handling (Fail): If invalid, the flow executes the Respond code 400 n8n node, immediately terminating the request and returning a helpful HTTP 400 error message to the client.


5. Data Retrieval (Success): If validation passes, the MongoDB n8n node executes a 'Find' operation to retrieve all documents from the specified collection.


6. Data Cleaning: The IDS format Code n8n node transforms the retrieved JSON data by renaming the default MongoDB identifier _id to the cleaner API standard id for consistency.


7. Final Response: The final Respond to Webhook n8n node returns the cleaned, transformed data as the ultimate HTTP 200 response to the originating API call. This complete n8n workflow showcases advanced API capabilities within n8n.

1. Import the n8n workflow: Copy the provided JSON data and paste it into your n8n instance using the 'Import Workflow' function.


2. Set up MongoDB Credentials: Locate the MongoDB n8n node and link it to your active MongoDB account credentials. Ensure this connection has read access to the relevant database.


3. Activate the Webhook n8n trigger: Save the n8n workflow and set it to 'Active'. Copy the resulting Webhook URL.


4. Testing: Access the endpoint using a structure like https:///webhook//mydatacollection to test the API. The n8n trigger should fire immediately.

Webhook (n8n trigger): Acts as the API endpoint. It is configured to capture the collection name dynamically via the /:nameCollection path parameter. Response mode is set to responseNode.
Validate Pattern (Code n8n node): The core security layer. This custom n8n node uses JavaScript and regex (/^(?!system\.)[a-zA-Z0-9.]{1,120}$/) to check against reserved names and invalid characters, a key feature in this n8n workflow.
If (n8n node): Crucial for flow control, routing execution based on the valid status derived from the collection name check.
Respond code 400 (n8n node): Dedicated error handler. Sends a structured JSON response with an HTTP 400 status when the input validation fails, ensuring professional API feedback.
MongoDB (n8n node): Connects to the database. The collection name is dynamically set using an expression: ={{ $json.collection }}.
IDS format (Code n8n node): Performs mandatory data transformation. This Code n8n node contains a function to replace the MongoDB-specific id field with a more API-friendly id field.

• Respond to Webhook (n8n node): Finalizes the successful execution path, sending the cleaned MongoDB data back to the originating client.