{"record":{"id":"7ddd9bb7f86e1afa","repo":"kestra-io/kestra","slug":"tenant-id-can-only-be-main","errorCode":null,"errorMessage":"Tenant id can only be 'main'","messagePattern":"Tenant id can only be 'main'","errorType":"exception","errorClass":"KestraRuntimeException","httpStatus":null,"severity":"error","filePath":"cli/src/main/java/io/kestra/cli/services/TenantIdSelectorService.java","lineNumber":17,"sourceCode":"package io.kestra.cli.services;\n\nimport org.apache.commons.lang3.StringUtils;\n\nimport io.kestra.core.exceptions.KestraRuntimeException;\n\nimport jakarta.inject.Singleton;\n\nimport static io.kestra.core.tenant.TenantService.MAIN_TENANT;\n\n@Singleton\npublic class TenantIdSelectorService {\n\n    //For override purpose in Kestra EE\n    public String getTenantId(String tenantId) {\n        if (StringUtils.isNotBlank(tenantId) && !MAIN_TENANT.equals(tenantId)) {\n            throw new KestraRuntimeException(\"Tenant id can only be 'main'\");\n        }\n        return MAIN_TENANT;\n    }\n\n    public String getTenantIdAndAllowEETenants(String tenantId) {\n        if (StringUtils.isNotBlank(tenantId)) {\n            return tenantId;\n        }\n        return MAIN_TENANT;\n    }\n\n    public void createTenant(String tenantId) {\n        //for override purpose\n    }\n}\n","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/cli/src/main/java/io/kestra/cli/services/TenantIdSelectorService.java#L1-L33","documentation":"Thrown by TenantIdSelectorService in Kestra OSS when a non-blank tenant id other than 'main' is supplied. OSS is single-tenant and only allows the MAIN_TENANT ('main'); any other tenant id is rejected with KestraRuntimeException. The EE edition overrides getTenantId to permit arbitrary tenants via getTenantIdAndAllowEETenants.","triggerScenarios":"A CLI command or service calls getTenantId(tenantId) where tenantId is non-blank and != 'main'; the guard throws KestraRuntimeException(\"Tenant id can only be 'main'\").","commonSituations":"Running OSS with --tenant acme, an EE-configured value left in env after downgrading to OSS, a script assuming multi-tenancy on OSS, or a misconfigured tenant header.","solutions":["On OSS, omit --tenant or pass --tenant main.","If you need multiple tenants, run Kestra Enterprise Edition.","Audit env vars / config for a stale tenant id after switching editions."],"exampleFix":"# before\nkestra flow test myflow.yaml --tenant acme\n# after (OSS)\nkestra flow test myflow.yaml --tenant main","handlingStrategy":"validation","validationCode":"if (StringUtils.isNotBlank(tenantId) && !MAIN_TENANT.equals(tenantId)) {\n  throw new IllegalArgumentException('OSS only allows tenant \"main\"; got ' + tenantId);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["On OSS, omit --tenant or pass main.","Switch to Enterprise Edition for multi-tenancy.","Audit env/config for stale tenant ids after edition changes."],"tags":["tenant","oss","configuration","multi-tenancy"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}