apolloconfig/apollo · error · UnsupportedOperationException

Not supported operation

Error message

Not supported operation

What it means

Thrown as UnsupportedOperationException by ConsumerPermissionValidator.hasCreateAppNamespacePermission. ConsumerPermissionValidator is the OpenAPI (third-party token/consumer) permission validator and intentionally rejects operations that only the interactive portal can perform. Creating AppNamespaces is not exposed through the consumer/OpenAPI permission model.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/auth/ConsumerPermissionValidator.java:65

      String namespaceName) {
    if (hasCreateNamespacePermission(appId)) {
      return true;
    }
    return super.hasModifyNamespacePermission(appId, env, clusterName, namespaceName);
  }

  @Override
  public boolean hasReleaseNamespacePermission(String appId, String env, String clusterName,
      String namespaceName) {
    if (hasCreateNamespacePermission(appId)) {
      return true;
    }
    return super.hasReleaseNamespacePermission(appId, env, clusterName, namespaceName);
  }

  @Override
  public boolean hasCreateAppNamespacePermission(String appId, AppNamespace appNamespace) {
    throw new UnsupportedOperationException("Not supported operation");
  }

  @Override
  public boolean isSuperAdmin() {
    // openapi shouldn't be
    return false;
  }

  @Override
  public boolean shouldHideConfigToCurrentUser(String appId, String env, String clusterName,
      String namespaceName) {
    throw new UnsupportedOperationException("Not supported operation");
  }

  @Override
  public boolean hasCreateApplicationPermission() {
    long consumerId = consumerAuthUtil.retrieveConsumerIdFromCtx();
    return permissionService.consumerHasPermission(consumerId, PermissionType.CREATE_APPLICATION,

View on GitHub (pinned to d95fc18d11)

Solutions

1. Use the portal UI / admin service (interactive user auth) to create AppNamespaces, not the OpenAPI consumer flow.
2. Ensure the request path selects the correct permission validator (user vs consumer).
3. Avoid invoking hasCreateAppNamespacePermission from OpenAPI-consumer-authenticated controllers.

// Do not invoke create-appnamespace permission via the consumer/openapi path.
// Route AppNamespace creation through portal admin (user principal) instead.

boolean isConsumerPrincipal = SecurityContextHolder.getContext().getAuthentication()
    .getPrincipal() instanceof ConsumerAuthenticationToken;
// guard: skip hasCreateAppNamespacePermission when isConsumerPrincipal is true

When it happens

Trigger: An OpenAPI request authenticated as a Consumer (token) reaches code that calls hasCreateAppNamespacePermission(appId, appNamespace) on the consumer validator.

Common situations: Routing a portal-only admin action through the OpenAPI consumer path; misconfigured permission validator bean selected for an openapi request; calling a portal endpoint with a consumer token.

Related errors

• userIds should not be null or empty
• Consumer already exist
• Token is Illegal
• Namespace's role does not exist. Please check whether namesp
• App admin permission is required

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/ff46c1b3d177689b. Report an issue: GitHub.