Metadata.Authorization.IdentityOrder contains undeclared ide

Error message

Metadata.Authorization.IdentityOrder contains undeclared identity %q

What it means

Compile-time guard in validateCommandMetadata: IdentityOrder names an identity not present in the Identities map.

Source

Thrown at shortcuts/common/typed_compiler.go:161

			}
			if conditional.When != strings.TrimSpace(conditional.When) {
				return fmt.Errorf("%s.When must be trimmed", path)
			}
			switch conditional.Requirement {
			case typedScopeRequired, typedScopeBestEffort:
			default:
				return fmt.Errorf("%s.Requirement %q is invalid", path, conditional.Requirement)
			}
		}
	}
	if len(metadata.Authorization.IdentityOrder) > 0 {
		if len(metadata.Authorization.IdentityOrder) != len(metadata.Authorization.Identities) {
			return fmt.Errorf("Metadata.Authorization.IdentityOrder must contain each declared identity exactly once")
		}
		seen := make(map[typedIdentity]struct{}, len(metadata.Authorization.IdentityOrder))
		for _, identity := range metadata.Authorization.IdentityOrder {
			if _, ok := metadata.Authorization.Identities[identity]; !ok {
				return fmt.Errorf("Metadata.Authorization.IdentityOrder contains undeclared identity %q", identity)
			}
			if _, duplicate := seen[identity]; duplicate {
				return fmt.Errorf("Metadata.Authorization.IdentityOrder contains duplicate identity %q", identity)
			}
			seen[identity] = struct{}{}
		}
	}
	return nil
}

func validateScopeList(scopes []string, path string) error {
	seen := make(map[string]struct{}, len(scopes))
	for i, scope := range scopes {
		if strings.TrimSpace(scope) == "" || scope != strings.TrimSpace(scope) {
			return fmt.Errorf("%s[%d] must be a non-blank trimmed scope", path, i)
		}
		if _, ok := seen[scope]; ok {
			return fmt.Errorf("%s contains duplicate scope %q", path, scope)

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Add the identity to Authorization.Identities with its authorization entry, or
Remove the undeclared identity from IdentityOrder
Fix typos so the order entry matches the exact identity key used in Identities

Example fix

// before
Identities: map[...]{User: {...}},
IdentityOrder: []common.TypedIdentity{common.TypedIdentityUser, common.TypedIdentityBot},
// after
Identities: map[...]{User: {...}},
IdentityOrder: []common.TypedIdentity{common.TypedIdentityUser},

Defensive patterns

Strategy: validation

Validate before calling

for _, id := range meta.Authorization.IdentityOrder { if _, ok := meta.Authorization.Identities[id]; !ok { return fmt.Errorf("undeclared identity %q", id) } }

Prevention

Only reference identity constants also used as Identities map keys
Fix typos by reusing the same typed constant in both places
Remove stale order entries when deleting identities

When it happens

Trigger: IdentityOrder includes e.g. "bot" while Identities map only declares "user"; a typo in the identity constant/name; deleting an identity from Identities but leaving it in IdentityOrder.

Common situations: Refactoring that removed an identity from Identities but not from the order slice; misspelled custom identity value; copying IdentityOrder from another command that declares more identities.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/16d00383a560c621. Report an issue: GitHub.