message for '%s' contains bad data format: missing allowlist

Error message

message for '%s' contains bad data format: missing allowlist name

What it means

After successfully unmarshaling an allowlist_unsubscribe payload, ManagementCmd requires a non-empty Name field to identify the allowlist being unsubscribed. This error is thrown when the payload decodes cleanly but 'name' is empty or absent, meaning the central API sent an incomplete unsubscribe command.

Source

Thrown at pkg/apiserver/papi_cmd.go:304

			}
			if deleted > 0 {
				log.Infof("deleted %d decisions from allowlists", deleted)
			}
		}
	case "allowlist_unsubscribe":
		data, err := json.Marshal(message.Data)
		if err != nil {
			return err
		}

		unsubscribeMsg := allowlistUnsubscribe{}

		if err := json.Unmarshal(data, &unsubscribeMsg); err != nil {
			return fmt.Errorf("message for '%s' contains bad data format: %w", message.Header.OperationType, err)
		}

		if unsubscribeMsg.Name == "" {
			return fmt.Errorf("message for '%s' contains bad data format: missing allowlist name", message.Header.OperationType)
		}

		if unsubscribeMsg.Id == "" {
			return fmt.Errorf("message for '%s' contains bad data format: missing allowlist id", message.Header.OperationType)
		}

		p.Logger.Infof("Received allowlist_unsubscribe command from PAPI, unsubscribing from allowlist %s", unsubscribeMsg.Name)

		if err := p.DBClient.DeleteAllowListByID(ctx, unsubscribeMsg.Name, unsubscribeMsg.Id, true); err != nil {
			if !ent.IsNotFound(err) {
				return err
			}

			p.Logger.Warningf("Allowlist %s not found", unsubscribeMsg.Name)
		}

		return nil
	default:

View on GitHub (pinned to 909b515798)

Solutions

Check crowdsec logs for the operation_type to identify the malformed command and inspect the corresponding allowlist in the console
Update crowdsec to the latest version so payload handling matches the current central API schema
If persistent, report the malformed message to CrowdSec; the command is rejected and processing continues, so no local action is strictly required
Verify no proxy or custom integration is dropping the 'name' field from PAPI messages

Example fix

// before: {"data":{"id":"42"}}
// after: include the name
// {"data":{"name":"my-allowlist","id":"42"}}

Defensive patterns

Strategy: validation

Validate before calling

msg, ok := message.Data.(map[string]interface{})
name, ok2 := msg["name"].(string)
if !ok || !ok2 || name == "" {
    return fmt.Errorf("allowlist_unsubscribe payload missing 'name'")
}

Type guard

func validAllowlistName(d map[string]interface{}) bool {
    n, ok := d["name"].(string)
    return ok && n != ""
}

Try / catch

if err := ManagementCmd(ctx, msg, p, false); err != nil {
    if strings.Contains(err.Error(), "missing allowlist name") {
        log.Warnf("skipping malformed PAPI command: %v", err)
        return nil
    }
    return err
}

Prevention

Keep the console and crowdsec versions aligned to avoid payload drift
Do not strip fields from PAPI messages in intermediaries
Alert on recurring 'missing allowlist name' log lines as a sender-side defect

When it happens

Trigger: An allowlist_unsubscribe message whose JSON data omits the 'name' key or sets it to "" — a placeholder/empty command emitted by the central API or produced by a schema change.

Common situations: Central console pushing an unsubscribe for a deleted allowlist with empty metadata; version mismatch between central API and local crowdsec; intermediaries stripping fields from the payload.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/377abb40a6c79c26. Report an issue: GitHub.