HumanSignal/label-studio · error · ValidationError

{connection validation error}

Error message

{connection validation error}

What it means

AzureBlobImportStorageSerializer.validate runs storage.validate_connection() with the request credentials and converts any exception into a DRF ValidationError whose message is extracted via extract_message(exc). This surfaces raw Azure SDK/credential errors (auth failures, missing container, empty prefix) as a 400 at serializer validation time.

Source

Thrown at label_studio/io_storages/azure_blob/serializers.py:40

            result.pop(attr)
        return result

    def validate(self, data):
        data = super(AzureBlobImportStorageSerializer, self).validate(data)
        storage = self.instance
        if storage:
            for key, value in data.items():
                setattr(storage, key, value)
        else:
            if 'id' in self.initial_data:
                storage_object = self.Meta.model.objects.get(id=self.initial_data['id'])
                for attr in AzureBlobImportStorageSerializer.secure_fields:
                    data[attr] = data.get(attr) or getattr(storage_object, attr)
            storage = self.Meta.model(**data)
        try:
            storage.validate_connection()
        except Exception as exc:
            raise ValidationError(extract_message(exc))
        return data


class AzureBlobExportStorageSerializer(ExportStorageSerializer):
    type = StorageTypeField(default='azure')

    def to_representation(self, instance):
        result = super().to_representation(instance)
        result.pop('account_name')
        result.pop('account_key')
        return result

    class Meta:
        model = AzureBlobExportStorage
        fields = '__all__'

View on GitHub (pinned to 0b49e9b539)

Solutions

1. Read the response detail — extract_message surfaces the concrete Azure error
2. Test credentials with 'az storage blob list' before configuring
3. Re-enter account_name/account_key cleanly (no stray whitespace) or set the env vars
4. Fix container/prefix per errors 127/128 guidance
5. Ensure network access to <account>.blob.core.windows.net

Example fix

// before
{"account_key": "<key-with-trailing-newline>", "container": "docs"}  → 400 AuthenticationFailed
// after
{"account_key": "<clean-key>", "container": "docs"}  → 201

# dry-run the credentials with the Azure SDK before POSTing the storage
from azure.storage.blob import BlobServiceClient
svc = BlobServiceClient(account_url=f"https://{account_name}.blob.core.windows.net", credential=account_key.strip())
list(svc.get_container_client(container).list_blob_names(name_starts_with=prefix or ""))[:1]

def azure_import_payload_ok(p):
    return bool(p.get("account_name") and p.get("account_key") and p.get("container"))

try:
    resp = requests.post(f"{LS_URL}/api/storages/azure/", json=payload, headers=headers)
    resp.raise_for_status()
except requests.HTTPError as e:
    detail = resp.json().get("detail", "")  # extracted Azure error message
    logging.error("Azure storage validation failed: %s", detail)

When it happens

Trigger: POST/PUT of an Azure Blob import storage where validate_connection throws — wrong account key (AuthenticationFailed), missing credentials, nonexistent container, or empty prefix — triggering the serializer's explicit connection check.

Common situations: Account key with whitespace/newline from copy-paste; storage being edited where secure (masked) fields are merged from the existing object but the original credentials were already invalid; container renamed; enterprise firewall blocking blob endpoint.

Related errors

• {underlying connection validation error}
• Container not found: {self.container}
• {self.url_scheme}://{self.container}/{self.prefix} not found
• Wrong credentials for S3 {bucket_name}
• Azure account name and key must be set using environment var

AI-assisted analysis of HumanSignal/label-studio@0b49e9b539 (2026-08-29). Data as JSON: /api/errors/91297ac484f205f5. Report an issue: GitHub.