{"record":{"id":"9e189999547c7cd5","repo":"apache/hadoop","slug":"illegalargumentexception-wrong-eek-op-value-it-mu","errorCode":null,"errorMessage":"IllegalArgumentException Wrong eek_op value, it must be generate or decrypt","messagePattern":"IllegalArgumentException Wrong eek_op value, it must be generate or decrypt","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java","lineNumber":548,"sourceCode":"        } catch (Exception e) {\n          LOG.error(\"Exception in generateEncryptedKeys:\", e);\n          throw new IOException(e);\n        }\n        kmsAudit.ok(user, KMSOp.GENERATE_EEK, name, \"\");\n        retJSON = new ArrayList();\n        for (EncryptedKeyVersion edek : retEdeks) {\n          ((ArrayList) retJSON).add(KMSUtil.toJSON(edek));\n        }\n      } else {\n        StringBuilder error;\n        error = new StringBuilder(\"IllegalArgumentException Wrong \");\n        error.append(KMSRESTConstants.EEK_OP);\n        error.append(\" value, it must be \");\n        error.append(KMSRESTConstants.EEK_GENERATE);\n        error.append(\" or \");\n        error.append(KMSRESTConstants.EEK_DECRYPT);\n        LOG.error(error.toString());\n        throw new IllegalArgumentException(error.toString());\n      }\n      KMSWebApp.getGenerateEEKCallsMeter().mark();\n      LOG.trace(\"Exiting generateEncryptedKeys method.\");\n      return Response.ok().type(MediaType.APPLICATION_JSON).entity(retJSON)\n              .build();\n    } catch (Exception e) {\n      LOG.debug(\"Exception in generateEncryptedKeys.\", e);\n      throw e;\n    }\n  }\n\n  @SuppressWarnings(\"rawtypes\")\n  @POST\n  @Path(KMSRESTConstants.KEY_RESOURCE + \"/{name:.*}/\" +\n      KMSRESTConstants.REENCRYPT_BATCH_SUB_RESOURCE)\n  @Consumes(MediaType.APPLICATION_JSON)\n  @Produces(MediaType.APPLICATION_JSON + \"; \" + JettyUtils.UTF_8)\n  public Response reencryptEncryptedKeys(","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java#L530-L566","documentation":"Thrown by the KMS REST resource generateEncryptedKeys (KMS.java:548), which serves GET /v1/key/{name}/_eek with the query parameter eek_op. In this code path only the literal value 'generate' is handled; every other value falls into the else branch, logs 'Wrong eek_op value, it must be generate or decrypt', and throws IllegalArgumentException, which the KMS exception mapper turns into an HTTP 400 response.","triggerScenarios":"Calling GET /v1/key/{keyName}/_eek?eek_op=<value> where <value> is anything but exactly 'generate': typos such as 'Generate' or 'gen', or values that belong to the other endpoint, e.g. eek_op=decrypt or eek_op=reencrypt (decrypt/reencrypt must be POSTed to /v1/keyversion/{versionName}/_eek, not to the key resource). A missing eek_op instead fails earlier with checkNotNull (KMS.java:503), so this error specifically means a present-but-unrecognized value.","commonSituations":"Client code copied from the decrypt flow and reused on the generate URL; Hadoop KeyProvider via KMSClientProvider hitting a version skew where eek_op semantics changed; hand-rolled curl calls with a typo in the query parameter; trailing whitespace or URL-encoding mistakes (e.g. eek_op=generate%0A).","solutions":["Send exactly eek_op=generate on GET /v1/key/{name}/_eek (add &num_keys=N if you need multiple EEKs)","For decryption use POST /v1/keyversion/{versionName}/_eek with eek_op=decrypt, and for re-encryption the same POST with eek_op=reencrypt","Prefer the Java API (KeyProviderCryptoExtension.generateEncryptedKey / KMSClientProvider) over hand-built URLs so the correct endpoint and parameter are chosen for you","Check for whitespace/case errors in the query string if the value looks correct"],"exampleFix":"# before\nGET /v1/key/mykey/_eek?eek_op=Generate\n# after\nGET /v1/key/mykey/_eek?eek_op=generate&num_keys=1","handlingStrategy":"validation","validationCode":"String op = \"generate\"; // must be exactly 'generate' for GET /key/{name}/_eek\nif (!\"generate\".equals(op))\n  throw new IllegalArgumentException(\"Use eek_op=generate on the key resource; decrypt/reencrypt belong to POST /keyversion/{v}/_eek\");\n// GET http://kms:9600/kms/v1/key/mykey/_eek?eek_op=generate","typeGuard":null,"tryCatchPattern":"try { kmsClient.generateEncryptedKeys(...); } catch (IllegalArgumentException e) { /* KMS maps to HTTP 400 */ if (e.getMessage().contains(\"eek_op\")) fixQueryParamAndRetry(); else throw e; }","preventionTips":["Prefer KeyProviderCryptoExtension.generateEncryptedKey over hand-built REST URLs","Centralize eek_op constants (generate/decrypt/reencrypt) in one enum in client code","Assert the endpoint/value pairing in one helper: generate->GET /key/{name}/_eek, decrypt|reencrypt->POST /keyversion/{v}/_eek"],"tags":["hadoop-kms","rest-api","http-400","invalid-parameter","key-management"],"backgroundTag":"rest-api-invalid-query-parameter","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}