apolloconfig/apollo · error · BadRequestException

operator should not be null or empty

Error message

operator should not be null or empty

What it means

Thrown by AppController.resolveOperator when the auth type is CONSUMER (OpenAPI token-based) and the operator parameter passed from the request is blank. For consumer-token requests, Apollo requires an explicit operator value because the token itself does not identify a human user. StringUtils.hasText(operator) must be true. Results in HTTP 400.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java:277

      return;
    }
    throw new AccessDeniedException("Create application permission is required");
  }

  private String resolveOperator(String operator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || !StringUtils.hasText(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      if (!StringUtils.hasText(operator)) {
        throw new BadRequestException("operator should not be null or empty");
      }
      if (userService.findByUserId(operator) == null) {
        throw BadRequestException.userNotExists(operator);
      }
      return operator;
    }

    throw new BadRequestException("Unsupported auth type: %s", authType);
  }

  private void validatePortalApp(OpenAppDTO app) {
    if (!UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())) {
      return;
    }
    if (!StringUtils.hasText(app.getName())) {
      throw BadRequestException.appNameIsBlank();
    }
    if (!InputValidator.isValidClusterNamespace(app.getAppId())) {

View on GitHub (pinned to d95fc18d11)

Solutions

1. Include a non-blank operator user ID in the request when authenticating with a consumer token.
2. Ensure the operator value is a valid user ID that exists in the user service (the next check, findByUserId, will reject unknown users).
3. If using a Java client, explicitly set the operator parameter on every consumer-token request.

Example fix

// before
// Consumer-token request without operator
api.createAppInEnv("DEV", app, null);

// after
// Consumer-token request with operator
api.createAppInEnv("DEV", app, "admin");

// For CONSUMER auth, ensure operator is provided and valid
if (UserIdentityConstants.CONSUMER.equals(UserIdentityContextHolder.getAuthType())) {
    if (operator == null || operator.trim().isEmpty()) {
        throw new IllegalArgumentException(
            "Operator user ID is required for consumer-token requests");
    }
    if (userService.findByUserId(operator) == null) {
        throw new IllegalArgumentException("Operator user does not exist: " + operator);
    }
}

When it happens

Trigger: Calling any AppController method that invokes resolveOperator (createApp with CONSUMER auth, createAppInEnv, updateApp, deleteApp) with a Consumer token but without providing an operator parameter, or providing an empty/whitespace operator.

Common situations: An OpenAPI client authenticates with a consumer token but does not include the operator field in the request body or header. The OpenAPI spec marks operator as optional but Apollo requires it for consumer-token auth. A client library version that doesn't send the operator field.

Related errors

• operator should not be null or empty
• Current user not found
• operator should not be null or empty
• userIds should not be null or empty
• Token is Illegal

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/ba60340b8d0aa0e6. Report an issue: GitHub.