apolloconfig/apollo · warning · NotFoundException

user token not found for id:%s

Error message

user token not found for id:%s

What it means

Thrown as a NotFoundException by UserTokenService.findOwnedToken() or findToken() when a UserToken with the given tokenId cannot be found. findOwnedToken also scopes by userId (findByIdAndUserId), so the token must both exist and belong to the operator. findToken uses findById and throws if the Optional is empty. Both indicate the token ID does not correspond to any persisted token (or not one owned by the caller).

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/UserTokenService.java:271

    if (userPermissionValidator.hasManageUsersPermission()) {
      operations.add(UserTokenOperation.USER_MANAGE);
    }
    if (userPermissionValidator.isSuperAdmin()) {
      operations.add(UserTokenOperation.SYSTEM_ADMIN);
    }
    return operations;
  }

  @Transactional
  public void createUserTokenAudits(Iterable<UserTokenAudit> userTokenAudits) {
    userTokenAuditRepository.saveAll(userTokenAudits);
  }

  private UserToken findOwnedToken(long tokenId, String operator) {
    validateOperator(operator);
    UserToken userToken = userTokenRepository.findByIdAndUserId(tokenId, operator);
    if (userToken == null) {
      throw new NotFoundException("user token not found for id:%s", tokenId);
    }
    return userToken;
  }

  private UserToken findToken(long tokenId) {
    return userTokenRepository.findById(tokenId)
        .orElseThrow(() -> new NotFoundException("user token not found for id:%s", tokenId));
  }

  private String normalizeStatus(String status) {
    if (StringUtils.isBlank(status)) {
      return TOKEN_STATUS_ALL;
    }
    String normalizedStatus = status.trim().toLowerCase(Locale.ROOT);
    if (TOKEN_STATUS_ALL.equals(normalizedStatus) || TOKEN_STATUS_ACTIVE.equals(normalizedStatus)
        || TOKEN_STATUS_EXPIRED.equals(normalizedStatus)
        || TOKEN_STATUS_REVOKED.equals(normalizedStatus)) {
      return normalizedStatus;

View on GitHub (pinned to d95fc18d11)

Solutions

1. List the current user's tokens via the token management API to find the correct tokenId.
2. Verify the tokenId belongs to the authenticated user (findOwnedToken enforces ownership).
3. If the token was deleted, it cannot be operated on — inform the user and create a new token if needed.
4. Ensure the tokenId is from the same Apollo environment/deployment.

// Verify token exists and belongs to the user before operating
UserToken token = userTokenRepository.findByIdAndUserId(tokenId, operator);
if (token == null) {
  throw new IllegalArgumentException(
    "Token not found or not owned by user: " + tokenId);
}

try {
  userTokenService.rotateToken(tokenId, operator);
} catch (NotFoundException e) {
  if (e.getMessage().contains("user token not found")) {
    log.warn("Token {} not found or not owned by {}", tokenId, operator);
    // refresh the token list in the UI
  }
  throw e;
}

When it happens

Trigger: Calling any operation that resolves a token by ID (rotateToken, revokeToken, etc.) with a tokenId that doesn't exist in the user_token table, or — for findOwnedToken — exists but belongs to a different user than the operator.

Common situations: Token was already deleted; token ID typo in the request; attempting to operate on another user's token (ownership mismatch); token ID from a different Apollo environment/deployment; stale client reference to a deleted token.

Related errors

• Assign role permission is required
• App not found: {appId}
• Access is denied
• Access is denied
• Access is denied

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/43fc4bc5ab7eb4e0. Report an issue: GitHub.