crowdsecurity/crowdsec · warning

operation '%s' unknown, continue

Error message

operation '%s' unknown, continue

What it means

A successfully parsed PAPI message carried a header.operation_type that is not in the server's operation map (decision, alert, management), so no handler exists and the order is skipped. This means the central API sent a command this crowdsec version does not understand — typically a newer operation type introduced after this build. The message says 'continue' because polling resumes with the next event.

Source

Thrown at pkg/apiserver/papi.go:148

	logger := p.Logger.WithField("request-id", event.RequestId)
	logger.Debugf("message received: %+v", event.Data)

	message := &Message{}
	if err := json.Unmarshal([]byte(event.Data), message); err != nil {
		return fmt.Errorf("polling papi message format is not compatible: %+v: %w", event.Data, err)
	}

	if message.Header == nil {
		return errors.New("no header in message, skipping")
	}

	if message.Header.Source == nil {
		return errors.New("no source user in header message, skipping")
	}

	operationFunc, ok := operationMap[message.Header.OperationType]
	if !ok {
		return fmt.Errorf("operation '%s' unknown, continue", message.Header.OperationType)
	}

	metrics.PapiOrdersReceived.WithLabelValues(message.Header.OperationType, message.Header.OperationCmd).Inc()

	logger.Debugf("Calling operation '%s'", message.Header.OperationType)

	err := operationFunc(ctx, message, p, sync)
	if err != nil {
		return fmt.Errorf("'%s %s failed: %w", message.Header.OperationType, message.Header.OperationCmd, err)
	}

	return nil
}

func (p *Papi) GetPermissions(ctx context.Context) (PapiPermCheckSuccess, error) {
	httpClient := p.apiClient.GetClient()
	papiCheckURL := fmt.Sprintf("%s%s%s", p.URL, PAPIVersion, PAPIPermissionsURL)

View on GitHub (pinned to 909b515798)

Solutions

1. Note the operation name printed in the error — it identifies the unsupported order type.
2. Upgrade crowdsec to the latest version, which knows the new operation types.
3. Check console management (`cscli console list` / console management enablement) and disable order types your version doesn't support if upgrade isn't possible.
4. If it's isolated to one message, it can be safely ignored — polling continues automatically.

if err := p.handleEvent(ctx, event, sync); err != nil {
    if strings.Contains(err.Error(), "unknown, continue") {
        logger.Warnf("skipping unsupported PAPI operation: %v", err) // non-fatal
        return
    }
}

When it happens

Trigger: handleEvent looks up operationMap[message.Header.OperationType]; a message with any operation_type other than 'decision', 'alert' or 'management' hits the !ok branch and returns this error.

Common situations: Running an outdated crowdsec while CAPI starts emitting new operation types; console order types enabled in the CrowdSec console that this version can't process; schema typo if pointing papi_url at a custom/test endpoint.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• no header in message, skipping
• no source user in header message, skipping
• polling papi message format is not compatible: %+v: %w
• errUnauthorized
• url is required

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/27e5802080cb80dd. Report an issue: GitHub.