apolloconfig/apollo · error · BadRequestException

App's role does not exist. Please check whether app has crea

Error message

App's role does not exist. Please check whether app has created.

What it means

Thrown by assignAppRoleToConsumer when the app's master role does not exist. The method looks up RoleUtils.buildAppMasterRoleName(appId) via rolePermissionService.findRoleByRoleName. Apollo creates the master role (and other app roles) during app creation. If the role is absent, the app was either never fully created through the Portal, or the role initialization failed. Results in HTTP 400.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/service/ConsumerService.java:338

  @Transactional
  public ConsumerRole assignAppRoleToConsumer(String token, String appId, String operator) {
    validateOperator(operator);
    Long consumerId = getConsumerIdByToken(token);
    return assignAppRoleToConsumer(consumerId, appId, operator);
  }

  @Transactional
  public ConsumerRole assignAppRoleToConsumer(Long consumerId, String appId, String operator) {
    validateOperator(operator);
    if (consumerId == null) {
      throw new BadRequestException("Token is Illegal");
    }

    Role masterRole =
        rolePermissionService.findRoleByRoleName(RoleUtils.buildAppMasterRoleName(appId));
    if (masterRole == null) {
      throw new BadRequestException(
          "App's role does not exist. Please check whether app has created.");
    }

    long roleId = masterRole.getId();
    ConsumerRole managedModifyRole =
        consumerRoleRepository.findByConsumerIdAndRoleId(consumerId, roleId);
    if (managedModifyRole != null) {
      return managedModifyRole;
    }

    ConsumerRole consumerRole = createConsumerRole(consumerId, roleId, operator);
    return consumerRoleRepository.save(consumerRole);
  }

  @Transactional
  public void createConsumerAudits(Iterable<ConsumerAudit> consumerAudits) {
    consumerAuditRepository.saveAll(consumerAudits);
  }

View on GitHub (pinned to d95fc18d11)

Solutions

Verify the app was created through the Portal UI/API (not inserted directly into the DB) so that role initialization completes.
Confirm the appId you are passing matches an actual Apollo application appId, not a consumer-app identifier.
Check the Role table in the portal DB for a row with role_name matching 'Master+<appId>' (via RoleUtils.buildAppMasterRoleName) — if absent, recreate the app.
If the app exists but roles are missing, re-trigger role initialization by calling the app-creation path or a repair script.

Example fix

// before
consumerService.assignAppRoleToConsumer(consumerId, appId, operator);

// after
Role masterRole = rolePermissionService.findRoleByRoleName(RoleUtils.buildAppMasterRoleName(appId));
if (masterRole == null) {
    throw new IllegalStateException(
        "App " + appId + " has no master role; create the app via Portal first");
}
consumerService.assignAppRoleToConsumer(consumerId, appId, operator);

Defensive patterns

Strategy: validation

Validate before calling

// Verify the app master role exists before attempting role assignment
Role masterRole = rolePermissionService.findRoleByRoleName(
    RoleUtils.buildAppMasterRoleName(appId));
if (masterRole == null) {
    throw new IllegalStateException(
        "App " + appId + " has no master role. Create the app via Portal first.");
}
consumerService.assignAppRoleToConsumer(consumerId, appId, operator);

Prevention

Always create apps through the Portal or the app-creation API so role initialization is automatic.
Before bulk-assigning consumer roles, run a pre-check that verifies master roles exist for all target appIds.
Never insert app records directly into the DB; the role-seeding step will be skipped.

When it happens

Trigger: Calling assignAppRoleToConsumer for an appId that has no corresponding app-master role row in the permission system. This happens when the app was created in an environment but the Portal DB role-seeding step was skipped or partially completed, or the appId is for a consumer-app record that was never a real Apollo application.

Common situations: The appId refers to a consumer token's appId (a technical identifier), not an actual Apollo application appId. The app was created directly in configservice/adminservice DB without going through Portal, so roles were never seeded. Cross-environment confusion: the app exists in DEV but role assignment is attempted against a portal DB that does not have it.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/628185602e7c847c. Report an issue: GitHub.