diff --git a/source/java/org/alfresco/rest/api/impl/NodesImpl.java b/source/java/org/alfresco/rest/api/impl/NodesImpl.java
index b39a89ccae..1b0f0a8b17 100644
--- a/source/java/org/alfresco/rest/api/impl/NodesImpl.java
+++ b/source/java/org/alfresco/rest/api/impl/NodesImpl.java
@@ -903,9 +903,9 @@ public class NodesImpl implements Nodes
                 String perm = kv.getKey();
                 String op = kv.getValue();
 
-                if (perm.equals(PermissionService.ADD_CHILDREN) && type.equals(Type.DOCUMENT))
+                if (perm.equals(PermissionService.ADD_CHILDREN) && Type.DOCUMENT.equals(type))
                 {
-                    // special case: do not return "create" (as an allowable op) for file/content types
+                    // special case: do not return "create" (as an allowable op) for file/content types - note: 'type' can be null
                     continue;
                 }
                 else if (perm.equals(PermissionService.DELETE) && (isSpecialNodeDoNotDelete(nodeRef, nodeTypeQName)))
diff --git a/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java b/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java
index a15c2c9e7b..aa184e5957 100644
--- a/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java
+++ b/source/test-java/org/alfresco/rest/api/tests/NodeApiTest.java
@@ -3600,8 +3600,23 @@ public class NodeApiTest extends AbstractBaseApiTest
         // -ve
         delete(URL_NODES, userId, siteNodeId, 403);
 
-        // cleanup
-        delete(URL_NODES, user1, folderId, 204);
+        // fix for REPO-514 (NPE for a node that was neither a file/document nor a folder)
+        Node n = new Node();
+        n.setName("o1");
+        n.setNodeType(TYPE_CM_OBJECT);
+        response = post(getNodeChildrenUrl(folderId), user1, toJsonAsStringNonNull(n), 201);
+        nodeResp = RestApiUtil.parseRestApiEntry(response.getJsonResponse(), Node.class);
+        String o1Id = nodeResp.getId();
+
+        params = new HashMap<>();
+        params.put("include", "allowableOperations");
+        response = getSingle(NodesEntityResource.class, user1, o1Id, params, 200);
+        nodeResp = RestApiUtil.parseRestApiEntry(response.getJsonResponse(), Node.class);
+        assertNotNull(nodeResp.getAllowableOperations());
+
+        // some cleanup
+        params = Collections.singletonMap("permanent", "true");
+        delete(URL_NODES, user1, folderId, params, 204);
     }
 
     @Override