SigNoz/signoz · error · errors.SignozError

CodeInvalidInput

CodeInvalidInput

Error message

checkErr.GetMessage()

What it means

Returned by BatchCheck when one of the per-check errors returned by OpenFGA is classified as an InputError; it is re-exposed as InvalidInput with OpenFGA's own message. This means the check request itself was malformed (bad object/relation/user format, invalid model).

Source

Thrown at pkg/authz/openfgaserver/server.go:426

	return string(expectedAuthModelBytes) == string(actualAuthModelBytes), nil

}

func (server *Server) getStoreIDandModelID() (string, string) {
	server.mtx.RLock()
	defer server.mtx.RUnlock()

	storeID := server.storeID
	modelID := server.modelID

	return storeID, modelID
}

func (server *Server) getCheckError(checkErr *openfgav1.CheckError) error {
	switch checkErr.GetCode().(type) {
	case *openfgav1.CheckError_InputError:
		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, checkErr.GetMessage())
	default:
		return errors.New(errors.TypeInternal, errors.CodeInternal, checkErr.GetMessage())
	}
}

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Log checkErr.GetMessage() / the OpenFGA response for the exact offending field
2. Validate object/relation/user strings against the current OpenFGA authorization model before batching
3. Ensure the authorization model version callers use matches the model deployed to OpenFGA

for _, t := range req.Tuples {
    if t.GetObject() == "" || t.GetRelation() == "" || t.GetUser() == "" {
        return fmt.Errorf("incomplete tuple: %+v", t)
    }
}

if err := server.BatchCheck(ctx, req); err != nil {
    if strings.Contains(err.Error(), "invalid input") { // log tuple details and return 400
        log.Warn("batch check input rejected", "err", err)
    }
}

When it happens

Trigger: Calling BatchCheck with malformed tuple data — invalid object URI, unknown relation for the model, malformed user string — causing OpenFGA to return CheckError with CheckError_InputError code.

Common situations: Passing resource IDs with typos or wrong format (non-UUID where model expects it); using a relation name not present in the current authorization model; model was rewritten but callers still send old relation names.

Related errors

• CodeTooManyRequests
• CodeInternal
• ErrCodeRoleInvalidInput
• ErrCodeRoleInvalidInput
• ErrCodeInvalidGatewayConfig

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/a7e1628a0c49197e. Report an issue: GitHub.