apolloconfig/apollo · warning · BadRequestException

Config can not be published by yourself.

Error message

Config can not be published by yourself.

What it means

Thrown as BadRequestException (HTTP 400) by ReleaseService.checkLock during a non-emergency publish when a NamespaceLock exists and its creator equals the current operator. Apollo prevents the user who locked a namespace from also publishing it, to enforce separation of duties (the locker must not also be the publisher).

Source

Thrown at apollo-biz/src/main/java/com/ctrip/framework/apollo/biz/service/ReleaseService.java:279

    checkLock(namespace, isEmergencyPublish, operator);

    Map<String, String> operateNamespaceItems = getNamespaceItems(namespace);

    Namespace parentNamespace = namespaceService.findParentNamespace(namespace);

    // branch release
    if (parentNamespace != null) {
      return publishBranchNamespace(parentNamespace, namespace, operateNamespaceItems, releaseName,
          releaseComment, operator, isEmergencyPublish, grayDelKeys);
    }
    throw new NotFoundException("Parent namespace not found");
  }

  private void checkLock(Namespace namespace, boolean isEmergencyPublish, String operator) {
    if (!isEmergencyPublish) {
      NamespaceLock lock = namespaceLockService.findLock(namespace.getId());
      if (lock != null && lock.getDataChangeCreatedBy().equals(operator)) {
        throw new BadRequestException("Config can not be published by yourself.");
      }
    }
  }

  private void mergeFromMasterAndPublishBranch(Namespace parentNamespace, Namespace childNamespace,
      Map<String, String> parentNamespaceItems, String releaseName, String releaseComment,
      String operator, Release masterPreviousRelease, Release parentRelease,
      boolean isEmergencyPublish) {
    // create release for child namespace
    Release childNamespaceLatestActiveRelease = findLatestActiveRelease(childNamespace);

    Map<String, String> childReleaseConfiguration;
    Collection<String> branchReleaseKeys;
    if (childNamespaceLatestActiveRelease != null) {
      childReleaseConfiguration =
          GSON.fromJson(childNamespaceLatestActiveRelease.getConfigurations(), GsonType.CONFIG);
      branchReleaseKeys = getBranchReleaseKeys(childNamespaceLatestActiveRelease.getId());
    } else {

View on GitHub (pinned to d95fc18d11)

Solutions

  1. Have a different user (who did not create the lock) perform the publish.
  2. Release/clear the NamespaceLock first, then publish.
  3. If separation of duties does not apply, use emergency publish (isEmergencyPublish=true) which bypasses the check.

Example fix

// before: same user locked then publishes -> 400 'Config can not be published by yourself.'
// after: clear the lock, then publish
namespaceLockService.unlock(namespaceId, operator);
releaseService.publish(...); // or pass isEmergencyPublish=true
Defensive patterns

Strategy: validation

Validate before calling

NamespaceLock lock = namespaceLockService.findLock(namespace.getId());
boolean lockOwnerIsOperator = lock != null && lock.getDataChangeCreatedBy().equals(operator);
if (lockOwnerIsOperator && !isEmergencyPublish) {
  // have another user publish, clear the lock, or use emergency publish
}

Try / catch

try {
  releaseService.publish(appId, env, cluster, ns, name, comment, operator, false, null);
} catch (BadRequestException e) {
  if (e.getMessage().contains("published by yourself")) {
    // escalate to a different operator or use isEmergencyPublish=true
  } else throw e;
}

Prevention

When it happens

Trigger: The same user who created/acquired the NamespaceLock attempts a normal publish of that namespace (isEmergencyPublish=false).

Common situations: Single-developer namespaces where the same person locks and publishes; service accounts used for both edit and publish; forgotten lock left by the current operator.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/33b51766d2bf24f8. Report an issue: GitHub.