OpenBB-finance/OpenBB · error · OpenBBError

Invalid URL '{url}'. Only URLs from 'esmis.nal.usda.gov' are

Error message

Invalid URL '{url}'. Only URLs from 'esmis.nal.usda.gov' are supported.

What it means

Guard inside weather_bulletin_download's extract_data: every URL passed via the query's 'urls' list must start with https://esmis.nal.usda.gov/. The check is a defensive SSRF-style allowlist ensuring the downloader only fetches USDA NAL ESMIS documents. Raised as OpenBBError wrapping a ValueError before any HTTP request is made.

Source

Thrown at openbb_platform/providers/government_us/openbb_government_us/models/weather_bulletin_download.py:65

        return GovernmentUsWeatherBulletinDownloadQueryParams(**params)

    @staticmethod
    async def aextract_data(
        query: GovernmentUsWeatherBulletinDownloadQueryParams,
        credentials: dict[str, Any] | None,
        **kwargs: Any,
    ) -> dict:
        """Extract the raw PDF content."""
        # pylint: disable=import-outside-toplevel
        from openbb_core.provider.utils.helpers import get_async_requests_session

        results: dict = {}
        urls = query.urls

        # Verify that all URLs are going to be valid USDA URLs
        for url in urls:
            if not url.lower().startswith("https://esmis.nal.usda.gov/"):
                raise OpenBBError(
                    ValueError(
                        f"Invalid URL '{url}'. Only URLs from 'esmis.nal.usda.gov' are supported."
                    )
                )
            if not url.lower().endswith(".pdf"):
                raise OpenBBError(
                    ValueError(
                        f"Invalid URL '{url}'. Only PDF documents are supported."
                    )
                )

        try:
            async with await get_async_requests_session() as session:
                session._max_field_size = 32768  # pylint: disable=protected-access

                for url in urls:
                    async with await session.get(url) as response:
                        if response.status != 200:

View on GitHub (pinned to 3e071fcc2c)

Solutions

1. Use canonical URLs beginning exactly with https://esmis.nal.usda.gov/ (get them from the weather_bulletin endpoint's results or the ESMIS site).
2. Strip 'www.' and force the https scheme before passing.
3. Validate URLs against the allowlist in your own code before invoking the download.

Example fix

# before
res = obb.economy.gov.weather_bulletin_download(urls=["https://example.com/bulletin.pdf"])

# after
res = obb.economy.gov.weather_bulletin_download(urls=["https://esmis.nal.usda.gov/catalog/download/..."])

ALLOWED_PREFIX = "https://esmis.nal.usda.gov/"

def is_usda_url(url: str) -> bool:
    return url.lower().startswith(ALLOWED_PREFIX)

def is_usda_esmis_url(u: str) -> bool is not None and isinstance(u, str) and u.lower().startswith("https://esmis.nal.usda.gov/")

When it happens

Trigger: Passing a URL from another host (http://, another domain, or with different casing/scheme such as 'https://www.esmis.nal.usda.gov/'), or passing a URL retrieved from a different source (e.g. a search result pointing elsewhere).

Common situations: Copy-pasting a generic USDA link instead of the ESMIS catalog link; prefixing 'www.'; passing an empty or malformed string.

Related errors

• Year must not be before 1974.
• Invalid year. Year cannot be in the future.
• Invalid URL '{url}'. Only PDF documents are supported.
• At least one extension type must be selected.
• Incorrect email or password

AI-assisted analysis of OpenBB-finance/OpenBB@3e071fcc2c (2026-08-14). Data as JSON: /api/errors/88c50d2972400cc1. Report an issue: GitHub.