What causes "allowlist '%s' not found" in crowdsecurity/crowdsec?

Run cscli allowlists list to get exact names, then retry with the correct name

allowlist '%s' not found

Error message

allowlist '%s' not found

What it means

GetAllowList queries the allowlists table by exact name (optionally with items) using ent's First(). When ent returns its NotFound error (no row matched), it is converted into a friendly 'allowlist '%s' not found' message. Any other query error is returned unwrapped.

Source

Thrown at pkg/database/allowlists.go:111

	result, err := q.All(ctx)
	if err != nil {
		return nil, fmt.Errorf("unable to list allowlists: %w", err)
	}

	return result, nil
}

func (c *Client) GetAllowList(ctx context.Context, name string, withContent bool) (*ent.AllowList, error) {
	q := c.Ent.AllowList.Query().Where(allowlist.NameEQ(name))
	if withContent {
		q = q.WithAllowlistItems()
	}

	result, err := q.First(ctx)
	if err != nil {
		if ent.IsNotFound(err) {
			return nil, fmt.Errorf("allowlist '%s' not found", name)
		}

		return nil, err
	}

	return result, nil
}

func (c *Client) GetAllowListByID(ctx context.Context, allowlistID string, withContent bool) (*ent.AllowList, error) {
	q := c.Ent.AllowList.Query().Where(allowlist.AllowlistIDEQ(allowlistID))
	if withContent {
		q = q.WithAllowlistItems()
	}

	result, err := q.First(ctx)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 909b515798)

Solutions

Run cscli allowlists list to get exact names, then retry with the correct name
Create the allowlist first (cscli allowlists create) if it does not exist
If acting by ID (console-managed lists), use GetAllowListByID instead
Check for hidden whitespace/case differences in scripts passing the name

Example fix

// before
list, err := client.GetAllowList(ctx, "My Allowlist", true) // exact-match fails
// after
list, err := client.GetAllowList(ctx, strings.TrimSpace(name), true)
if err != nil { /* create it or abort with a clear message */ }

Defensive patterns

Strategy: validation

Validate before calling

lists, err := client.ListAllowLists(ctx, false)
if err != nil { return err }
exists := false
for _, l := range lists { if l.Name == name { exists = true; break } }
if !exists { return fmt.Errorf("allowlist %q not found; available: %v", name, names) }

Try / catch

list, err := client.GetAllowList(ctx, name, true)
if err != nil {
    if strings.Contains(err.Error(), "not found") { return fmt.Errorf("unknown allowlist %q", name) }
    return err
}

Prevention

Copy allowlist names from cscli allowlists list instead of typing them
Remember the lookup is exact-match on name
For console-managed allowlists, prefer ID-based lookups

When it happens

Trigger: Client.GetAllowList(ctx, name, withContent) — reached from CLI delete/add/remove, import_allowlist, and the API GetAllowlist handler — when no allowlist with exactly that name exists.

Common situations: Typo in the allowlist name on cscli allowlists add/remove/import; referencing an allowlist before it was created or after console sync removed it; case/whitespace mismatch since the match is exact (NameEQ).

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2c6eab8a4e780856. Report an issue: GitHub.