diff --git a/profiles/killbill/src/main/java/org/killbill/billing/server/security/TenantFilter.java b/profiles/killbill/src/main/java/org/killbill/billing/server/security/TenantFilter.java
index 29dc32c..c37c20a 100644
--- a/profiles/killbill/src/main/java/org/killbill/billing/server/security/TenantFilter.java
+++ b/profiles/killbill/src/main/java/org/killbill/billing/server/security/TenantFilter.java
@@ -147,7 +147,7 @@ public class TenantFilter implements Filter {
}
private boolean isPermissionRequest(final String path, final String httpMethod) {
- return JaxrsResource.SECURITY_PATH.startsWith(path) && "GET".equals(httpMethod);
+ return path != null && path.startsWith(JaxrsResource.SECURITY_PATH) && "GET".equals(httpMethod);
}
private boolean isTenantCreationRequest(final String path, final String httpMethod) {