VPP Token Assignment and GitOps Issue

[reeblybeebly]

Fleet version: 4.72.0

---

💥  Actual behavior

customer-kokkola stated that when attempting to configure VPP assignment via gitops they receive an error for an existing team, there is however no error when performing a dry-run of the same gitops update.

Error Message

[+] applying 4 app store apps for team <customer> VIP Computers
Error: applying app store apps for team: "<customer> VIP Computers": POST /api/latest/fleet/software/app_store_apps/batch received status 422 Unprocessable Entity: could not retrieve vpp token: No available VPP Token

🛠️ To fix

Product designer: @marko-lisica

If running the command without the dry-run flag throws an error, the same error should occur when running with the dry-run flag.

When a team doesn't have a VPP token assigned, we see the expected error in GitOps when adding app_store_apps to a team YAML file. We should see the same error when running command with --dry-run flag.

🧑‍💻  Steps to reproduce

1. Confirmed with customer errors did not appear in dry-run
2. Confirmed with customer that this team did already exist prior to performing gitops update

🕯️ More info (optional)

Slack Threads
https://fleetdm.slack.com/archives/C08HNQD4XP1/p1756381134939989
https://fleetdm.slack.com/archives/C019WG4GH0A/p1756313045609699

[Sampfluger88]

Linked to Unthread ticket:

VPP Token Assignment and GitOps Issue #8169

[PezHub]

QA Reproduction Notes -

• confirmed when a team (Workstations) does not have a VPP token assigned we see the expected error in GitOps when applying the team yml.

./build/fleetctl gitops -f ~/fleetdm/gitops-local/PezHub/Export/teams/workstations.yml                         03:09:39 PM
[+] applying MDM profiles for team 💻 Workstations
[+] applying 0 software packages for team 💻 Workstations
[+] applying 1 app store apps for team 💻 Workstations
Error: applying app store apps for team: "💻 Workstations": POST /api/latest/fleet/software/app_store_apps/batch received status 422 Unprocessable Entity: could not retrieve vpp token: No available VPP Token

Corresponding server error =

level=error ts=2025-09-02T22:13:05.383659Z component=http user=gabelopez@fleetdm.com method=POST uri="/api/latest/fleet/software/app_store_apps/batch?overwrite=true&team_name=%F0%9F%92%BB+Workstations" took=8.917041ms err="could not retrieve vpp token: No available VPP Token" uuid=92027bde-4e8e-4b76-8648-ae49c6b5f560

• When running the same fleetctl gitops command with the --dry-run flag we don't get an error, confirming the BUG

./build/fleetctl gitops -f ~/fleetdm/gitops-local/PezHub/Export/teams/workstations.yml --dry-run               03:16:18 PM
[+] applying MDM profiles for team 💻 Workstations
[+] applying 0 software packages for team 💻 Workstations
[+] applying 1 app store apps for team 💻 Workstations
[+] would've applied 1 teams
[+] syncing 5 policies
[!] gitops dry run succeeded

Nothing server side either -

level=debug ts=2025-09-02T22:16:43.192861Z component=http user=gabelopez@fleetdm.com method=POST uri="/api/latest/fleet/software/batch?dry_run=true&overwrite=true&team_name=%F0%9F%92%BB+Workstations" took=5.216125ms
ts=2025-09-02T22:16:43.192884Z request_uuid=c17a3d8d-d659-4d57-a2ef-a27895933057 team_id=1 payloads=0 status=completed took=2.084µs msg="software batch done"
level=debug ts=2025-09-02T22:16:43.198065Z component=http user=gabelopez@fleetdm.com method=GET uri="/api/latest/fleet/software/batch/c17a3d8d-d659-4d57-a2ef-a27895933057?dry_run=true&overwrite=true&team_name=%F0%9F%92%BB+Workstations" took=424.375µs
level=debug ts=2025-09-02T22:16:43.207757Z component=http user=gabelopez@fleetdm.com method=POST uri="/api/latest/fleet/software/app_store_apps/batch?dry_run=true&overwrite=true&team_name=%F0%9F%92%BB+Workstations" took=4.455791ms
level=debug ts=2025-09-02T22:16:43.221645Z component=http user=gabelopez@fleetdm.com method=GET uri=/api/latest/fleet/teams/1/policies took=9.1065ms
level=debug ts=2025-09-02T22:16:43.229678Z component=http user=gabelopez@fleetdm.com method=GET uri="/api/latest/fleet/queries?team_id=1" took=3.425416ms
``