alibaba/spring-ai-alibaba · error · YAMLException

Type "token" is not allowed.

Error message

Type "token" is not allowed.

What it means

OpenApiUtils.checkSchemaExtension rejects user-sourced OpenAPI schema parameters whose declared type is "token". The "token" type is reserved for the platform's authentication mechanism, so allowing it in a user-defined parameter would let callers shadow or intercept credential injection. A YAMLException is thrown during RESTful method parsing to fail fast on the invalid definition.

Source

Thrown at spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/api/OpenApiUtils.java:603

	 * @param schemaField Schema field name
	 * @param schema Schema object
	 * @param resultList List to store results
	 * @param currentDepth Current recursion depth
	 * @throws YAMLException If recursion depth limit is reached
	 */
	private static void checkSchemaExtension(String schemaField, Schema<?> schema, List<ApiParameter> resultList,
			int currentDepth) throws YAMLException {
		if (currentDepth >= MAX_DEPTH) {
			throw new YAMLException(String.format("Schema extensions recursion depth limit(%d) reached.", MAX_DEPTH));
		}

		if (!CollectionUtils.isEmpty(schema.getExtensions())) {
			Object paramSource = schema.getExtensions().get(DEFINED_EXTENSION);
			if (paramSource instanceof String && String.valueOf(paramSource).equals(EXTENSION_USER_SOURCE)) {
				String type = schema.getType();
				// 防止用户使用 "token" 类型的参数
				if (StringUtils.isNotBlank(type) && TOKEN_TYPE.equals(type)) {
					throw new YAMLException("Type \"token\" is not allowed.");
				}

				ApiParameter param = new ApiParameter();
				param.setKey(schemaField);
				param.setType(type);
				param.setDescription(schema.getDescription());
				resultList.add(param);
			}
		}

		if (StringUtils.isNotBlank(schema.getType()) && "object".equals(schema.getType())
				&& !CollectionUtils.isEmpty(schema.getProperties())) {
			schema.getProperties()
				.forEach((propName, propSchema) -> checkSchemaExtension(propName, (Schema<?>) propSchema, resultList,
						currentDepth + 1));
		}
	}

View on GitHub (pinned to f82da0b50f)

Solutions

1. Change the schema type from "token" to "string" for the user-defined parameter
2. Remove the parameter entirely if it was intended to carry an auth token — the platform injects credentials itself
3. Remove the user-source extension if the parameter is not meant to be user-editable
4. Re-parse the spec after the fix; the error is thrown at import/parse time, not runtime

Example fix

// before (OpenAPI YAML)
parameters:
  - name: accessToken
    in: header
    schema:
      type: token
// after
parameters:
  - name: accessToken
    in: header
    schema:
      type: string

boolean isUserTokenParam(Schema<?> schema) {
    Object src = schema.getExtensions() == null ? null : schema.getExtensions().get("x-param-source");
    return EXTENSION_USER_SOURCE.equals(String.valueOf(src)) && "token".equals(schema.getType());
}
// reject before import: if (isUserTokenParam(schema)) throw ...

try {
    OpenApiUtils.parseRestfulMethod(...);
} catch (YAMLException e) {
    log.error("Invalid OpenAPI definition: {}", e.getMessage());
    // surface to user as spec import failure
}

When it happens

Trigger: Parsing an OpenAPI spec where a schema node carries the user-source extension (x- parameter source equal to EXTENSION_USER_SOURCE) and schema.getType() equals "token". Raised from checkSchemaExtension, which is invoked recursively by parseRestfulMethod and by itself for nested properties.

Common situations: Hand-writing an OpenAPI YAML for a custom plugin/API tool and declaring an auth header parameter as type token; exporting a spec from another tool that uses "token" as a schema type; copying examples where an Authorization parameter was typed as token instead of string.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• BuildToolSchemaError
• Parameter Not Allow Object Type
• TOOL_PARAMS_INVALID
• Param Not Support Object
• Param Not Support Array<Object>

AI-assisted analysis of alibaba/spring-ai-alibaba@f82da0b50f (2026-09-09). Data as JSON: /api/errors/6489ff4e7a1e0ea2. Report an issue: GitHub.