apolloconfig/apollo · warning · BadRequestException

userIds should not be null or empty

Error message

userIds should not be null or empty

What it means

Thrown as BadRequestException (HTTP 400) by ServerPermissionOpenApiService.addCreateApplicationRoleToUsers when the userIds list is null or empty (CollectionUtils.isEmpty). Assigning the create-application role requires at least one target user.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/server/service/ServerPermissionOpenApiService.java:232

  public void assignAppRoleToUser(String appId, String roleType, String userId, String operator) {
    assignRole(RoleUtils.buildAppRoleName(appId, roleType), roleType, userId, operator);
  }

  @Override
  public void removeAppRoleFromUser(String appId, String roleType, String userId, String operator) {
    removeRole(RoleUtils.buildAppRoleName(appId, roleType), roleType, userId, operator);
  }

  @Override
  public Map<String, Boolean> hasCreateApplicationPermission(String userId) {
    return Collections.singletonMap(HAS_CREATE_APPLICATION_PERMISSION,
        systemRoleManagerService.hasCreateApplicationPermission(userId));
  }

  @Override
  public void addCreateApplicationRoleToUsers(List<String> userIds, String operator) {
    if (CollectionUtils.isEmpty(userIds)) {
      throw new BadRequestException("userIds should not be null or empty");
    }
    userIds.forEach(this::checkUserExists);
    rolePermissionService.assignRoleToUsers(SystemRoleManagerService.CREATE_APPLICATION_ROLE_NAME,
        new HashSet<>(userIds), operator);
  }

  @Override
  public void deleteCreateApplicationRoleFromUser(String userId, String operator) {
    RequestPrecondition.checkArgumentsNotEmpty(userId);
    checkUserExists(userId);
    rolePermissionService.removeRoleFromUsers(SystemRoleManagerService.CREATE_APPLICATION_ROLE_NAME,
        Sets.newHashSet(userId), operator);
  }

  @Override
  public List<String> getCreateApplicationRoleUsers() {
    Set<UserInfo> users = rolePermissionService
        .queryUsersWithRole(SystemRoleManagerService.CREATE_APPLICATION_ROLE_NAME);

View on GitHub (pinned to d95fc18d11)

Solutions

1. Validate userIds is non-empty before calling.
2. Short-circuit (no-op) in the caller when there are no users to authorize.

Example fix

// before
permissionService.addCreateApplicationRoleToUsers(filteredUsers, operator); // 400 if filteredUsers empty
// after
if (!filteredUsers.isEmpty()) {
  permissionService.addCreateApplicationRoleToUsers(filteredUsers, operator);
}

if (!CollectionUtils.isEmpty(userIds)) {
  permissionService.addCreateApplicationRoleToUsers(userIds, operator);
}

When it happens

Trigger: Calling addCreateApplicationRoleToUsers(userIds, operator) with an empty list or null.

Common situations: Caller built the list from a filter that returned no users; deserialization producing an empty array; guard missing at the API client.

Related errors

• AppId not equal. AppId in path = %s, AppId in payload = %s
• operator should not be null or empty
• Params(AppId) can not be empty.
• Params(NamespaceName) can not be empty.
• Please enter at least one search criterion in either key or

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/69d1692923813173. Report an issue: GitHub.