OpenNHP/opennhp · error

fail to call trusted application with error

Error message

fail to call trusted application with error: %s

What it means

CallTrustedApplication returned an error when the agent tried to execute the TA function with the resolved policyId; the agent wraps it as 'fail to call trusted application'. The underlying cause is inside the wrapped message — network to the TA/DB, wrong function/params, or policy rejection.

Solutions

1. Read the wrapped inner error (%s) for the actual cause
2. Verify taId, function name, and params against the TA's published interface
3. Check connectivity/credentials to the trusted application / nhp-db and retry

if taId == "" || function == "" || policyId == "" {
    return fmt.Errorf("taId, function and policyId are required before TA call")
}

res, err := a.AccessData(ztdoId, taId, fn, params)
if err != nil && strings.Contains(err.Error(), "fail to call trusted application") {
    log.Errorf("TA call failed: %v", err) // inner cause is embedded
    // check TA endpoint health / credentials before retry
}

When it happens

Trigger: AccessData flow with a valid policyId where a.CallTrustedApplication(taId, function, params, policyId) fails — unreachable TA endpoint, invalid taId/function name, rejected params, or DHP transport error.

Common situations: Wrong taId or function name; confidential-computing backend down; data path (params['path']) pointing to a missing temp file; authentication with the TA expired.

Related errors

• Failed to refresh SDP
• Error: fail to find policyId for ztdoId
• fail to unmarshal confidential computing result
• access url is empty, please check with data provider
• failed to parse default route

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/c80cbd9241722731. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/agent/udpagent.go:1291

		if refreshSdp {
			output, err = a.RefreshDataAccess(ztdoId, decrypted, output)
			if err != nil {
				return nil, fmt.Errorf("Failed to refresh SDP: %s", err.Error())
			}
		}
	}

	// inject data path to params
	params["path"] = output

	var exist bool
	if policyId, exist = a.smartPolicyIdentifier[ztdoId]; !exist {
		return nil, fmt.Errorf("Error: fail to find policyId for ztdoId %s.\n", ztdoId)
	}

	taRes, err := a.CallTrustedApplication(taId, function, params, policyId)
	if err != nil {
		return nil, fmt.Errorf("fail to call trusted application with error: %s\n", err.Error())
	} else {
		var structResult map[string]any

		err := json.Unmarshal([]byte(taRes), &structResult)
		if err != nil {
			return nil, fmt.Errorf("fail to unmarshal confidential computing result: %s\n", err.Error())
		}

		return structResult, nil
	}
}

func (a *UdpAgent) PreCheckDataAccess(ztdoId string) (output string, refreshSdp bool, decrypted bool) {
	output = ""

	// Check whether the smart data policy needs to be refreshed
	if sdpRefreshTime, exist := a.smartDataPolicyRefreshTime[ztdoId]; exist {
		if time.Now().UnixNano()-sdpRefreshTime > SmartDataPolicyRefreshTime {

View on GitHub (pinned to 6e04ca5ff0)