crowdsecurity/crowdsec · warning

unknown command '%s' for operation type '%s'

Error message

unknown command '%s' for operation type '%s'

What it means

DecisionCmd dispatches on the message's OperationCmd. When the command is neither of the handled values (e.g. not 'delete'), this error reports the unknown command and operation type. It means PAPI sent an operation this crowdsec version does not understand.

Source

Thrown at pkg/apiserver/papi_cmd.go:84

		decisions := make([]*models.Decision, 0)

		for _, deletedDecision := range deletedDecisions {
			log.Infof("Decision from '%s' for '%s' (%s) has been deleted", deletedDecision.Origin, deletedDecision.Value, deletedDecision.Type)
			dec := &models.Decision{
				UUID:     deletedDecision.UUID,
				Origin:   &deletedDecision.Origin,
				Scenario: &deletedDecision.Scenario,
				Scope:    &deletedDecision.Scope,
				Value:    &deletedDecision.Value,
				ID:       int64(deletedDecision.ID),
				Until:    deletedDecision.Until.String(),
				Type:     &deletedDecision.Type,
			}
			decisions = append(decisions, dec)
		}
		p.Channels.DeleteDecisionChannel <- decisions
	default:
		return fmt.Errorf("unknown command '%s' for operation type '%s'", message.Header.OperationCmd, message.Header.OperationType)
	}

	return nil
}

func AlertCmd(ctx context.Context, message *Message, p *Papi, sync bool) error {
	switch message.Header.OperationCmd {
	case "add":
		data, err := json.Marshal(message.Data)
		if err != nil {
			return err
		}

		alert := &models.Alert{}

		if err := json.Unmarshal(data, alert); err != nil {
			return fmt.Errorf("message for '%s' contains bad alert format: %w", message.Header.OperationType, err)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Upgrade crowdsec to a version supporting the new PAPI command
2. Confirm the sender is a stock crowdsec console/CAPI, not custom tooling
3. Log the full message header to identify what command is being sent

knownCmds := map[string]bool{"delete": true}; if !knownCmds[msg.Header.OperationCmd] { /* upgrade or ignore */ }

if err := DecisionCmd(ctx, msg, p, false); err != nil { if strings.HasPrefix(err.Error(), "unknown command") { log.Warnf("unsupported PAPI command, consider upgrading: %v", err) } }

When it happens

Trigger: A PAPI message arrives whose Header.OperationCmd is not implemented in the switch — typically a newer server sending a command unknown to this binary.

Common situations: Version skew: PAPI/CAPI server newer than the local crowdsec; custom fork sending proprietary commands; corrupted message header.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• no header in message, skipping
• no source user in header message, skipping
• unknown cookie version
• errUnauthorized
• url is required

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6fd778623572c8dc. Report an issue: GitHub.