Budibase/budibase · error

Error getting status

Error message

Error getting status

What it means

While paging drives, the @odata.nextLink returned by Graph must point at https://graph.microsoft.com/v1.0/... (checked by isAllowedSharePointNextLink). If a nextLink is not a valid URL on that exact host/port/path prefix, the loop throws this HTTPError instead of following it. This is a server-side SSRF guard against following attacker-influenced pagination URLs.

Source

Thrown at packages/backend-core/src/accounts/accounts.ts:78

  const json: CloudAccount[] = await response.json()
  return json[0]
}

export const getStatus = async (): Promise<
  HealthStatusResponse | undefined
> => {
  if (EXIT_EARLY) {
    return
  }
  const response = await api.get(`/api/status`, {
    headers: {
      [Header.API_KEY]: env.ACCOUNT_PORTAL_API_KEY,
    },
  })
  const json = await response.json()

  if (response.status !== 200) {
    throw new Error(`Error getting status`)
  }

  return json
}

View on GitHub (pinned to a81a902e9a)

Solutions

1. Ensure requests reach graph.microsoft.com directly — remove or fix proxies that rewrite response URLs.
2. If using a sovereign cloud (graph.microsoft.us, graph.microsoft.de), the built-in allowlist does not cover it; host against the global cloud or adjust SHAREPOINT_API_BASE.
3. Check for network middleboxes/traffic interception altering the response body.
4. Reproduce the failing nextLink by logging payload['@odata.nextLink'] and validate it parses to https://graph.microsoft.com/v1.0/.

const isSafeNextLink = (link: string) => {
  try {
    const u = new URL(link)
    return u.protocol === "https:" && u.hostname === "graph.microsoft.com" && u.pathname.startsWith("/v1.0/")
  } catch { return false }
}
// call listSharePointDrives only in environments where Graph responses are not rewritten

const isValidNextLink = (v: unknown): v is string =>
  typeof v === "string" && (() => { try { const u = new URL(v); return u.protocol === "https:" && u.hostname === "graph.microsoft.com" && u.pathname.startsWith("/v1.0/") } catch { return false } })()

try {
  await listSharePointDrives(token, siteId)
} catch (e) {
  if (e instanceof Error && e.message === "Invalid SharePoint pagination URL") {
    // environment is rewriting Graph responses — check proxy/TLS appliances
  } else throw e
}

When it happens

Trigger: A response payload's '@odata.nextLink' is a relative URL, a different host (e.g. a proxy or national cloud like graph.microsoft.us), an http:// URL, or unparseable garbage.

Common situations: Requests routed through a corporate proxy that rewrites Graph URLs; mocking layers returning hand-crafted nextLinks; Graph national-sovereign clouds (different hostname) not supported by this allowlist; tampered/MITM responses.

Related errors

• Could not refresh OAuth Token
• Invitation is not valid or has expired, please request a new
• Invalid SharePoint pagination URL
• Error getting account by email ${email}
• Error getting account by tenantId ${tenantId}

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/e1920e9c1cd44f82. Report an issue: GitHub.