RocketChat/Rocket.Chat · error · Error

Invalid url. It doesn't exist or is not "application/zip".

Error message

Invalid url. It doesn't exist or is not "application/zip".

What it means

Thrown after both marketplace fetches succeed (the promises did not reject) but the download response's Content-Type header is not exactly 'application/zip'. The marketplace returned something that is not a zip package, so the buffer step is unsafe and the install aborts. Distinct from errors 184/185 which fire when the fetch promise itself rejects.

Source

Thrown at apps/meteor/ee/server/apps/communication/rest.ts:327

									.catch((cause) => {
										throw new Error('App package download failed', { cause });
									}),
								Apps.getMarketplaceClient()
									.fetch(`v1/apps/${this.bodyParams.appId}?appVersion=${this.bodyParams.version}`, {
										headers: {
											Authorization: `Bearer ${marketplaceToken}`,
											...headers,
										},
										// SECURITY: user needs specific privileges to send this. Bypassing the SSRF check is okay for now.
										ignoreSsrfValidation: true,
									})
									.catch((cause) => {
										throw new Error('App metadata download failed', { cause });
									}),
							]);

							if (downloadResponse.headers.get('content-type') !== 'application/zip') {
								throw new Error('Invalid url. It doesn\'t exist or is not "application/zip".');
							}

							buff = Buffer.from(await downloadResponse.arrayBuffer());
							marketplaceInfo = await marketplaceResponse.json();

							// Note: marketplace responds with an array of the marketplace info on the app, but it is expected
							// to always have one element since we are fetching a specific app version.
							if (!Array.isArray(marketplaceInfo) || marketplaceInfo?.length !== 1) {
								orchestrator.getRocketChatLogger().error({ msg: 'Error getting app information from marketplace', marketplaceInfo });
								throw new Error('Invalid response from the Marketplace');
							}

							permissionsGranted = this.bodyParams.permissionsGranted;
						} catch (err: unknown) {
							let message;

							if (err instanceof Error) {
								orchestrator.getRocketChatLogger().error({ msg: 'Error installing app from marketplace:', err });

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Inspect the marketplace response manually (the server logs the full error path); identify what content type was returned.
  2. If a proxy is intercepting, add the marketplace host to proxy bypass or configure HTTPS_PROXY correctly.
  3. Retry against a known-good app version to isolate whether the artifact itself is malformed.
  4. Report to marketplace ops if a valid version consistently returns non-zip content.
Defensive patterns

Strategy: validation

Validate before calling

function assertZipContentType(headers: Headers) {
  if (headers.get('content-type') !== 'application/zip') {
    throw new Error(`Expected application/zip, got ${headers.get('content-type')}`);
  }
}

Type guard

const isZipResponse = (res: Response): boolean =>
  res.headers.get('content-type') === 'application/zip';

Try / catch

try {
  await installMarketplaceApp(appId, version);
} catch (e) {
  if (e instanceof Error && e.message.includes('application/zip')) {
    // marketplace returned non-zip; likely an HTML error page or proxy interception
    investigateProxyOrMarketplaceStatus();
  }
}

Prevention

When it happens

Trigger: POST /api/v1/apps marketplace install where the marketplace download endpoint returns 200 but with a different content type (e.g. text/html error page, application/json, application/gzip, or a redirect to an HTML login page).

Common situations: Marketplace returns an HTML error/landing page with a 200 status instead of failing properly; a man-in-the-middle or captive proxy returns HTML; the app version is a legacy non-zip artifact; content negotiation returned a gzipped stream.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/f0ca77c6719f6382. Report an issue: GitHub.