apolloconfig/apollo · error · BadRequestException

The App Id of path variable and request body is different

Error message

The App Id of path variable and request body is different

What it means

Thrown by AppController.updateApp (PUT/PATCH app endpoint) when the appId in the URL path variable does not match the appId in the request body (dto.getAppId()). Apollo enforces consistency between the path and body to prevent accidental cross-app updates. Objects.equals(appId, dto.getAppId()) must be true. Results in HTTP 400.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java:178

    if (!hasReadApplicationPermissionForCurrentIdentity(appId)) {
      throw new BadRequestException("App not found: " + appId);
    }
    List<OpenAppDTO> apps = appOpenApiService.getAppsInfo(Collections.singletonList(appId));
    if (null == apps || apps.isEmpty()) {
      throw new BadRequestException("App not found: " + appId);
    }
    return ResponseEntity.ok(apps.get(0));
  }

  /**
   * update app (new added)
   */
  @Override
  @PreAuthorize(value = "@unifiedPermissionValidator.isAppAdmin(#appId)")
  @ApolloAuditLog(type = OpType.UPDATE, name = "App.update")
  public ResponseEntity<Void> updateApp(String appId, OpenAppDTO dto, String operator) {
    if (!Objects.equals(appId, dto.getAppId())) {
      throw new BadRequestException("The App Id of path variable and request body is different");
    }
    validatePortalApp(dto);
    String resolvedOperator = resolveOperator(operator);
    dto.setDataChangeLastModifiedBy(resolvedOperator);
    appOpenApiService.updateApp(dto, resolvedOperator);

    return ResponseEntity.ok().build();
  }

  /**
   * Get the current Consumer's application list (paginated) (new added)
   */
  @Override
  public ResponseEntity<List<OpenAppDTO>> getAppsBySelf(Integer page, Integer size) {
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {
      return ResponseEntity
          .ok(page(filterReadableApps(this.appOpenApiService.getAllApps()), page, size));
    }

View on GitHub (pinned to d95fc18d11)

Solutions

1. Ensure the appId in the request body exactly matches the appId in the URL path.
2. Set dto.setAppId(appId) from the path variable before sending the update request.
3. In client code, derive the body appId from the path variable rather than maintaining two separate values.

Example fix

// before
// PUT /openapi/v1/apps/my-app-A
OpenAppDTO dto = fetchTemplate("my-app-B"); // wrong appId
dto.setName("Updated Name");
api.updateApp("my-app-A", dto, operator);

// after
OpenAppDTO dto = fetchExisting(appId);
dto.setAppId(appId); // sync with path variable
dto.setName("Updated Name");
api.updateApp(appId, dto, operator);

// Sync the body appId with the path variable before updating
dto.setAppId(appId); // appId from path variable
if (!Objects.equals(appId, dto.getAppId())) {
    throw new IllegalStateException("Path appId and body appId must match");
}
appController.updateApp(appId, dto, operator);

When it happens

Trigger: Calling updateApp with a URL path like /apps/my-app-A and a request body containing {"appId": "my-app-B", ...}. The mismatch between path and body triggers the guard immediately, before any validation or persistence.

Common situations: A client copies a request body template from one app and forgets to update the appId field to match the URL. An automation script iterates over multiple apps but passes a static body. A frontend bug where the form state and URL get out of sync.

Related errors

• userIds should not be null or empty
• operator should not be null or empty
• ConsumerApp not exist
• App is null
• AppId is null or blank

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/0cc5c190283c6dd7. Report an issue: GitHub.