{"record":{"id":"59eeef1e3641a662","repo":"apolloconfig/apollo","slug":"create-application-permission-is-required","errorCode":null,"errorMessage":"Create application permission is required","messagePattern":"Create application permission is required","errorType":"http","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java","lineNumber":261,"sourceCode":"  }\n\n  private void requireCreateAppInEnvPermission() {\n    String authType = UserIdentityContextHolder.getAuthType();\n    if (UserIdentityConstants.USER.equals(authType)) {\n      // The legacy Portal WebAPI path for creating an app in a missing environment did not\n      // perform method-level authorization. Keep Portal UI behavior compatible after routing\n      // it through OpenAPI, but do not extend that compatibility to consumer tokens.\n      return;\n    }\n    if (UserIdentityConstants.CONSUMER.equals(authType)\n        && unifiedPermissionValidator.hasCreateApplicationPermission()) {\n      return;\n    }\n    if (UserIdentityConstants.USER_TOKEN.equals(authType)\n        && unifiedPermissionValidator.hasCreateApplicationPermission()) {\n      return;\n    }\n    throw new AccessDeniedException(\"Create application permission is required\");\n  }\n\n  private String resolveOperator(String operator) {\n    String authType = UserIdentityContextHolder.getAuthType();\n    if (UserIdentityConstants.USER.equals(authType)\n        || UserIdentityConstants.USER_TOKEN.equals(authType)) {\n      UserInfo loginUser = userInfoHolder.getUser();\n      if (loginUser == null || !StringUtils.hasText(loginUser.getUserId())) {\n        throw new BadRequestException(\"Current user not found\");\n      }\n      return loginUser.getUserId();\n    }\n\n    if (UserIdentityConstants.CONSUMER.equals(authType)) {\n      if (!StringUtils.hasText(operator)) {\n        throw new BadRequestException(\"operator should not be null or empty\");\n      }\n      if (userService.findByUserId(operator) == null) {","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java#L243-L279","documentation":"Thrown by AppController.requireCreateAppInEnvPermission when none of the auth-type permission conditions are satisfied. For USER auth type, permission is always granted (legacy compatibility). For CONSUMER and USER_TOKEN, unifiedPermissionValidator.hasCreateApplicationPermission() must return true. If the auth type is unrecognized or the permission check fails, AccessDeniedException is thrown. Results in HTTP 403.","triggerScenarios":"Calling createAppInEnv with a CONSUMER or USER_TOKEN identity that lacks the CreateApplication system-level permission. Also thrown if the auth type in UserIdentityContextHolder is none of USER, CONSUMER, or USER_TOKEN.","commonSituations":"A consumer token was created but never assigned the CreateApplication system role (via assignCreateApplicationRoleToConsumer). A user-token belongs to a user without app-creation privileges. The auth filter failed to set a recognized auth type in the context holder.","solutions":["Grant the CreateApplication system role to the consumer token via assignCreateApplicationRoleToConsumer(token, operator).","For user-tokens, ensure the user has the CreateApplication permission in the Portal system settings.","Verify the authentication filter is correctly populating UserIdentityContextHolder with a valid auth type."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// For CONSUMER auth, verify create-app permission before calling createAppInEnv\nif (UserIdentityConstants.CONSUMER.equals(UserIdentityContextHolder.getAuthType())) {\n    if (!unifiedPermissionValidator.hasCreateApplicationPermission()) {\n        throw new AccessDeniedException(\n            \"Consumer token lacks CreateApplication system role. Assign it first.\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Assign the CreateApplication system role to consumer tokens that need to create apps.","Verify the current identity has create-application permission before scripting app creation.","Use USER identity for interactive app creation in the Portal UI."],"tags":["openapi","authorization","app-creation","apollo-portal","permission","system-role"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}