{"record":{"id":"fd9405c5eef0bbdd","repo":"goharbor/harbor","slug":"bad-request-fd9405","errorCode":"BAD_REQUEST","errorMessage":"unknown namespace","messagePattern":"unknown namespace","errorType":"validation","errorClass":"github.com/goharbor/harbor/src/lib/errors.Error","httpStatus":400,"severity":"error","filePath":"src/controller/robot/controller.go","lineNumber":365,"sourceCode":"\t\tif !ok {\n\t\t\tlog.Debugf(\"got no namespace from the resource %s\", scope)\n\t\t\treturn \"\", \"\", errors.Errorf(\"got no namespace from the resource %s\", scope)\n\t\t}\n\t\tpro, err := d.proMgr.Get(ctx, ns.Identity())\n\t\tif err != nil {\n\t\t\treturn \"\", \"\", err\n\t\t}\n\t\tnamespace = pro.Name\n\t}\n\treturn\n}\n\n// toScope ...\nfunc (d *controller) toScope(ctx context.Context, p *Permission) (string, error) {\n\tswitch p.Kind {\n\tcase LEVELSYSTEM:\n\t\tif p.Namespace != \"/\" {\n\t\t\treturn \"\", errors.New(nil).WithMessage(\"unknown namespace\").WithCode(errors.BadRequestCode)\n\t\t}\n\t\treturn SCOPESYSTEM, nil\n\tcase LEVELPROJECT:\n\t\tif p.Namespace == \"*\" {\n\t\t\treturn SCOPEALLPROJECT, nil\n\t\t}\n\t\tpro, err := d.proMgr.Get(ctx, p.Namespace)\n\t\tif err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\treturn fmt.Sprintf(\"/project/%d\", pro.ProjectID), nil\n\t}\n\treturn \"\", errors.New(nil).WithMessage(\"unknown robot kind\").WithCode(errors.BadRequestCode)\n}\n\n// set the project info if it's a project level robot\nfunc SetProject(ctx context.Context, r *Robot) error {\n\tif r == nil {","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/controller/robot/controller.go#L347-L383","documentation":"The robot controller's toScope (src/controller/robot/controller.go:365) converts a Permission into an access scope. For kind 'system' (LEVELSYSTEM) the namespace must be exactly '/'; any other namespace value is rejected as unknown with BAD_REQUEST (HTTP 400). Project-level permissions use the project name or '*' instead.","triggerScenarios":"POST /api/v2.0/robots (or PUT /robots/{id}) with a permissions entry like {\"kind\": \"system\", \"namespace\": \"\"}, {\"kind\": \"system\", \"namespace\": \"library\"}, or {\"kind\": \"system\", \"namespace\": \"*\"}.","commonSituations":"Reusing a project-level permission template for system scope; omitting namespace and expecting a default; copying permission JSON from docs where '/' was lost by URL normalization.","solutions":["For system-wide scope set kind=system with namespace=\"/\"","For project scope set kind=project with namespace=<project_name> or '*' for all projects","Validate the (kind, namespace) pairs in your client before submitting"],"exampleFix":"// before\n{\"permissions\": [{\"kind\": \"system\", \"namespace\": \"myproject\", \"access\": [...]}]}  // 400\n\n// after\n{\"permissions\": [{\"kind\": \"project\", \"namespace\": \"myproject\", \"access\": [...]}]}\n// or system-wide:\n{\"permissions\": [{\"kind\": \"system\", \"namespace\": \"/\", \"access\": [...]}]}","handlingStrategy":"validation","validationCode":"func validatePermission(p Permission) error {\n    switch p.Kind {\n    case \"system\":\n        if p.Namespace != \"/\" { return errors.New(\"system scope requires namespace '/'\") }\n    case \"project\":\n        if p.Namespace != \"*\" && !validProjectName(p.Namespace) { return errors.New(\"invalid project namespace\") }\n    default:\n        return errors.New(\"unknown permission kind\")\n    }\n    return nil\n}","typeGuard":"func isUnknownNamespaceErr(err error) bool {\n    return errors.IsErr(err, errors.BadRequestCode) &&\n        strings.Contains(err.Error(), \"unknown namespace\")\n}","tryCatchPattern":"if _, err := robotCtl.CreateRobot(...); err != nil {\n    if errors.IsErr(err, errors.BadRequestCode) && strings.Contains(err.Error(), \"unknown namespace\") {\n        // fix (kind, namespace) pair: system=>'/', project=>name|'*'\n    }\n}","preventionTips":["Treat (kind=system, namespace='/') as the only system-scope shape","Use kind=project with the project name or '*' for project scopes","Validate permission arrays in client code before POST /robots"],"tags":["harbor","robot-account","permissions","rbac","validation"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}