FlowiseAI/Flowise · error · Error

Failed to post ${url}: ${error}

Error message

Failed to post ${url}: ${error}

What it means

Thrown by API_DocumentLoaders when an outbound POST via secureAxiosRequest rejects. Because secureAxiosRequest sets validateStatus: () => true, HTTP 4xx/5xx responses do NOT trigger this; only connection-level failures do (DNS, timeout, TLS, 'Too many redirects', or an SSRF deny-list hit from resolveAndValidate). The original error is stringified into the message, losing its shape.

Source

Thrown at packages/components/nodes/documentloaders/API/APILoader.ts:289

            throw new Error(`Failed to fetch ${url}: ${error}`)
        }
    }

    protected async executePostRequest(url: string, headers?: ICommonObject, body?: ICommonObject, ca?: string): Promise<IDocument[]> {
        try {
            const config: AxiosRequestConfig = { method: 'POST', url, data: body ?? {}, headers: headers ?? {} }
            const agentOptions = ca ? { ca } : undefined
            const response = await secureAxiosRequest(config, 5, agentOptions)
            const responseJsonString = JSON.stringify(response.data, null, 2)
            const doc = new Document({
                pageContent: responseJsonString,
                metadata: {
                    url
                }
            })
            return [doc]
        } catch (error) {
            throw new Error(`Failed to post ${url}: ${error}`)
        }
    }
}

module.exports = {
    nodeClass: API_DocumentLoaders
}

View on GitHub (pinned to abe4a8601a)

Solutions

1. Verify the URL is reachable from the host (curl -X POST) and that the scheme/host are correct.
2. If the endpoint uses a private/self-signed CA, supply the PEM via the node's 'ca' input so secureAxiosRequest can build a pinned agent.
3. Check the SSRF deny list (resolveAndValidate in httpSecurity.ts) if pointing at internal infrastructure; route through a public endpoint or allow-list it.
4. For redirect-heavy endpoints, raise the maxRedirects budget (currently hardcoded to 5) or resolve the final URL upstream.

Example fix

// before
const response = await secureAxiosRequest(config, 5, agentOptions)
// after - surface the real cause instead of stringifying
try {
  const response = await secureAxiosRequest(config, 5, agentOptions)
} catch (error) {
  if (axios.isAxiosError(error)) {
    throw new Error(`Failed to post ${url}: ${error.code ?? 'ERR'} ${error.message}`)
  }
  throw new Error(`Failed to post ${url}: ${error instanceof Error ? error.message : String(error)}`)
}

import axios from 'axios'
import { isWebUri } from 'valid-url'

async function preflight(url: string, body: unknown, headers: Record<string, string>, ca?: string) {
  if (!isWebUri(url)) throw new Error(`Refusing POST: not a valid web URL: ${url}`)
  if (body !== undefined && typeof body !== 'object') {
    throw new Error('POST body must be an object or undefined')
  }
  const parsed = new URL(url)
  if (parsed.hostname === 'localhost' || /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(parsed.hostname)) {
    // will be rejected by resolveAndValidate anyway; fail fast with a clear message
    throw new Error('Refusing POST to private/internal host (SSRF guard would block)')
  }
}
// await preflight(url, body, headers, ca) before secureAxiosRequest

function isAxiosLikeError(e: unknown): e is { message: string; code?: string; response?: { status: number; data: unknown } } {
  return typeof e === 'object' && e !== null && 'message' in e && typeof (e as any).message === 'string'
}

try {
  const docs = await apiLoader.load()
} catch (error) {
  const msg = error instanceof Error ? error.message : String(error)
  if (/ENOTFOUND|ECONNREFUSED|ETIMEDOUT/.test(msg)) {
    // transport - retry or surface to user
  } else if (/redirect|deny|private/i.test(msg)) {
    // SSRF guard or redirect budget - do not retry, fix the URL
  }
  throw error
}

When it happens

Trigger: POSTing to an unreachable/typo'd URL; target server drops the connection; mutual-TLS CA mismatch (ca param wrong); request crosses more than 5 redirects; URL resolves to a private/internal IP blocked by the deny list; default 5-redirect budget exceeded.

Common situations: Mis-configured API node URL or headers; corporate proxy stripping the Host header; self-signed endpoint supplied without the matching 'ca' PEM; pointing at a localhost/internal service that the SSRF guard intentionally blocks.

Related errors

• Failed to fetch ${url}: ${error}
• Failed to make GET request: ${error instanceof Error ? error
• Failed to make POST request: ${error instanceof Error ? erro
• Failed to make PUT request: ${error instanceof Error ? error
• Access to this host is denied by policy.

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/9bf497605451b771. Report an issue: GitHub.