{"record":{"id":"1872b7df042d2ed6","repo":"apache/dolphinscheduler","slug":"request-params-not-valid-error","errorCode":"REQUEST_PARAMS_NOT_VALID_ERROR","errorMessage":"REQUEST_PARAMS_NOT_VALID_ERROR","messagePattern":"REQUEST_PARAMS_NOT_VALID_ERROR","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AccessTokenServiceImpl.java","lineNumber":115,"sourceCode":"    /**\n     * create token\n     *\n     * @param loginUser loginUser\n     * @param userId token for user\n     * @param expireTime token expire time\n     * @param token token string (if it is absent, it will be automatically generated)\n     * @return create result code\n     */\n    @SuppressWarnings(\"checkstyle:WhitespaceAround\")\n    @Override\n    public AccessToken createToken(User loginUser, int userId, String expireTime, String token) {\n\n        // 1. check permission\n        checkAccessTokenTargetUserIsLoginUserOrAdmin(loginUser, userId);\n\n        // 2. check if user is existed\n        if (userId <= 0) {\n            throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR,\n                    \"User id: \" + userId + \" should not less than or equals to 0.\");\n        }\n\n        // 3. generate access token if absent\n        if (StringUtils.isBlank(token)) {\n            token = EncryptionUtils.getMd5(userId + expireTime + System.currentTimeMillis());\n        }\n\n        // 4. persist to the database\n        AccessToken accessToken = new AccessToken();\n        accessToken.setUserId(userId);\n        accessToken.setExpireTime(DateUtils.stringToDate(expireTime));\n        accessToken.setToken(token);\n        accessToken.setCreateTime(new Date());\n        accessToken.setUpdateTime(new Date());\n\n        int insert = accessTokenDao.insert(accessToken);\n","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AccessTokenServiceImpl.java#L97-L133","documentation":"createToken validates inputs before minting an access token; when userId is <= 0 it throws ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR) with a message that the user id must be greater than 0. This guards against creating tokens bound to an invalid or absent user.","triggerScenarios":"Calling createToken (POST /access-tokens) with userId 0, negative, or null-coerced-to-0 — typically when the caller omitted the userId field, the form sent an empty string, or the wrong variable was bound.","commonSituations":"API clients omitting userId in the request body so it defaults to 0; UI forms not populating the user dropdown before submit; scripts passing the token's own id instead of a user id; property binding of \"\" to int yielding 0.","solutions":["Pass the id of an existing user (> 0) in the create-token request; look it up via the users API if unknown.","Fix the client form/script so userId is populated before submitting (require field selection).","If the value comes from config, verify the configured user id actually exists and is not 0/-1 placeholder.","Validate the payload client-side before calling the API."],"exampleFix":"// before: empty form field bound to 0\n{\"userId\": 0, \"expireTime\": \"2026-01-01\"}\n\n// after: real user id\n{\"userId\": 42, \"expireTime\": \"2026-01-01\"}","handlingStrategy":"validation","validationCode":"// validate payload before the API call\nif (userId == null || userId <= 0) {\n    throw new IllegalArgumentException(\"userId must be a positive existing user id\");\n}","typeGuard":"boolean validUserId(Integer userId) { return userId != null && userId > 0; }","tryCatchPattern":"try {\n    accessTokenService.createToken(loginUser, userId, expireTime, token);\n} catch (ServiceException e) {\n    if (e.getCode() == Status.REQUEST_PARAMS_NOT_VALID_ERROR) {\n        throw new IllegalArgumentException(\"Provide a valid userId > 0\", e);\n    }\n    throw e;\n}","preventionTips":["Make userId a required, validated field in client forms and scripts.","Resolve user ids via the users API instead of hard-coding.","Reject empty-string/0 values at the client boundary.","Check request bindings when mapping JSON bodies onto DTOs."],"tags":["validation","access-token","api","parameters"],"backgroundTag":"invalid-argument-value","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}