apache/beam · error · UnsupportedOperationException

The provided allow list does not enable expanding a…

Error message

The provided allow list does not enable expanding a transform class by the name ${className}.

What it means

getAllowedClass found no allowlist entry whose isAllowedClass matches the requested class name, so the expansion service refuses to instantiate that transform class. This UnsupportedOperationException signals the class is not permitted by the current allowlist.

Solutions

1. Add the fully-qualified class name (or wildcard package entry) to allowedClasses in the allowlist YAML.
2. Verify the requested className exactly matches the entry (package, class, case).
3. Redeploy/restart the expansion service after editing the allowlist.

Example fix

# before
allowedClasses:
  - className: org.apache.beam.sdk.transforms.MapElements
# after
allowedClasses:
  - className: org.apache.beam.sdk.transforms.MapElements
  - className: com.mycompany.transforms.MyTransform

boolean allowed = provider.getAllowedClasses().stream()
    .anyMatch(c -> c.isAllowedClass(requestedClassName));
if (!allowed) throw new IllegalArgumentException("Class not in allowlist: " + requestedClassName);

Optional<AllowedClass> findAllowed(AllowList list, String cn) { return list.getAllowedClasses().stream().filter(c -> c.isAllowedClass(cn)).findFirst(); }

try { AllowedClass ac = provider.getAllowedClass(className); } catch (UnsupportedOperationException e) { log.warn("Class not allowed: {}", className); throw new ExpansionNotAllowedException(e); }

When it happens

Trigger: Requesting expansion of a class not listed in allowlist YAML; class listed under a different fully-qualified name; the service loaded a stale/different allowlist file.

Common situations: Adding a new transform without updating the allowlist; class renamed/moved packages; wrong allowlist mounted in the container.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Wildcard builder not allowed for non-wildcard class.
• Builder method has to be explicitly allowed
• Builder method name has to be explicitly allowed
• Constructor method needs to be explicitly allowed
• Found two matching allowlist classes

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/63bc22d80a25c9d1. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/expansion-service/src/main/java/org/apache/beam/sdk/expansion/service/JavaClassLookupTransformProvider.java:548

    }

    public abstract String getVersion();

    public abstract List<AllowedClass> getAllowedClasses();

    public AllowedClass getAllowedClass(String className) {
      AllowedClass allowlistClass = null;
      for (AllowedClass cls : getAllowedClasses()) {
        if (cls.isAllowedClass(className)) {
          if (allowlistClass != null) {
            throw new IllegalArgumentException(
                "Found two matching allowlist classes " + allowlistClass + " and " + cls);
          }
          allowlistClass = cls;
        }
      }
      if (allowlistClass == null) {
        throw new UnsupportedOperationException(
            "The provided allow list does not enable expanding a transform class by the name "
                + className
                + ".");
      }
      return allowlistClass;
    }

    static AllowList create(String version, List<AllowedClass> allowedClasses) {
      if (allowedClasses == null) {
        allowedClasses = new ArrayList<>();
      }
      return new AutoValue_JavaClassLookupTransformProvider_AllowList(version, allowedClasses);
    }
  }

  @AutoValue
  public abstract static class AllowedClass {

View on GitHub (pinned to 12126d8942)