What causes "allowlist '%s' already exists" in crowdsecurity/crowdsec?

List existing allowlists (cscli allowlists list) and pick a different name

allowlist '%s' already exists

Error message

allowlist '%s' already exists

What it means

CreateAllowList inserts a new allowlist row; a unique constraint on the allowlist name was violated, so the database refused the insert. Unlike the generic creation failure, this is a deterministic conflict: an allowlist with the same name already exists.

Source

Thrown at pkg/database/allowlists.go:33

	"github.com/crowdsecurity/crowdsec/pkg/database/ent/allowlist"
	"github.com/crowdsecurity/crowdsec/pkg/database/ent/allowlistitem"
	"github.com/crowdsecurity/crowdsec/pkg/database/ent/decision"
	"github.com/crowdsecurity/crowdsec/pkg/database/ent/predicate"
	"github.com/crowdsecurity/crowdsec/pkg/models"
)

const allowlistExpireDecisionsBatchSize = 300

func (c *Client) CreateAllowList(ctx context.Context, name string, description string, allowlistID string, fromConsole bool) (*ent.AllowList, error) {
	allowlist, err := c.Ent.AllowList.Create().
		SetName(name).
		SetFromConsole(fromConsole).
		SetDescription(description).
		SetAllowlistID(allowlistID).
		Save(ctx)
	if err != nil {
		if sqlgraph.IsUniqueConstraintError(err) {
			return nil, fmt.Errorf("allowlist '%s' already exists", name)
		}

		return nil, fmt.Errorf("unable to create allowlist: %w", err)
	}

	return allowlist, nil
}

func (c *Client) DeleteAllowList(ctx context.Context, name string, fromConsole bool) error {
	nbDeleted, err := c.Ent.AllowListItem.Delete().Where(allowlistitem.HasAllowlistWith(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole))).Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to delete allowlist items: %w", err)
	}

	c.Log.Debugf("deleted %d items from allowlist %s", nbDeleted, name)

	nbDeleted, err = c.Ent.AllowList.
		Delete().

View on GitHub (pinned to 909b515798)

Solutions

List existing allowlists (cscli allowlists list) and pick a different name
Use the update/edit flow instead of create for the existing allowlist
If the stale duplicate is unwanted, delete it first (DeleteAllowList)
Check for hidden whitespace in the name argument

Example fix

// before
al, err := client.CreateAllowList(ctx, "my-allowlist", "desc", alID, false)
// after
existing, _ := client.GetAllowListByName(ctx, "my-allowlist")
if existing != nil {
    return fmt.Errorf("allowlist exists, editing instead")
}
al, err := client.CreateAllowList(ctx, "my-allowlist", "desc", alID, false)

Defensive patterns

Strategy: validation

Validate before calling

existing, err := client.GetAllowListByName(ctx, name)
if err == nil && existing != nil {
    return fmt.Errorf("allowlist %q already exists", name)
}

Type guard

func allowlistExists(err error) bool {
    return err != nil && strings.Contains(err.Error(), "already exists")
}

Try / catch

al, err := client.CreateAllowList(ctx, name, desc, id, false)
if err != nil {
    var notFound *ent.NotFoundError
    if strings.Contains(err.Error(), "already exists") {
        // fetch and reuse/edit the existing allowlist
    }
    return err
}

Prevention

Check for an existing allowlist with the same name before creating
Use consistent naming conventions (and trim whitespace) for allowlist names
In automation, make creation idempotent: query first, create only if missing
Be aware console-synced allowlists share the same namespace as local ones

When it happens

Trigger: c.CreateAllowList(ctx, name, description, allowlistID, fromConsole) where 'name' matches an existing allowlist row — e.g. cscli allowlist create with a duplicate name, or console-synced allowlist colliding with a locally created one.

Common situations: Re-running an init script that creates allowlists; creating an allowlist in cscli whose name was already pushed from the console; whitespace/case differences assumed unique but not distinct.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8f5336f880751759. Report an issue: GitHub.