SigNoz/signoz · error · basemodel.ApiError

couldn't create cloud integration service account: %w

Error message

couldn't create cloud integration service account: %w

What it means

Thrown when the ServiceAccount module's GetOrCreate call fails while creating (or fetching) the dedicated cloud-integration service account for an org. It is wrapped as an internal error, meaning the failure is on the server side (database or model layer), not caller input. The account is created with name 'integration' on the configured email domain and must be uniquely owned by the org.

Source

Thrown at ee/query-service/app/api/cloudIntegrations.go:142

			"couldn't create cloud integration PAT: %w", err,
		))
	}

	factorAPIKey, err = ah.Signoz.Modules.ServiceAccount.GetOrCreateFactorAPIKey(ctx, factorAPIKey)
	if err != nil {
		return "", basemodel.InternalError(fmt.Errorf(
			"couldn't create cloud integration PAT: %w", err,
		))
	}
	return factorAPIKey.Key, nil
}

func (ah *APIHandler) getOrCreateCloudIntegrationServiceAccount(ctx context.Context, orgId valuer.UUID) (*serviceaccounttypes.ServiceAccount, *basemodel.ApiError) {
	domain := ah.Signoz.Modules.ServiceAccount.Config().Email.Domain
	cloudIntegrationServiceAccount := serviceaccounttypes.NewServiceAccount("integration", domain, serviceaccounttypes.ServiceAccountStatusActive, orgId)
	cloudIntegrationServiceAccount, err := ah.Signoz.Modules.ServiceAccount.GetOrCreate(ctx, orgId, cloudIntegrationServiceAccount)
	if err != nil {
		return nil, basemodel.InternalError(fmt.Errorf("couldn't create cloud integration service account: %w", err))
	}
	_, err = ah.Signoz.Modules.ServiceAccount.SetRoleByName(ctx, orgId, cloudIntegrationServiceAccount.ID, authtypes.SigNozViewerRoleName)
	if err != nil {
		return nil, basemodel.InternalError(fmt.Errorf("couldn't create cloud integration service account: %w", err))
	}

	return cloudIntegrationServiceAccount, nil
}

func (ah *APIHandler) getIngestionUrlAndSigNozAPIUrl(ctx context.Context, licenseKey string) (
	string, *basemodel.ApiError,
) {
	// TODO: remove this struct from here
	type deploymentResponse struct {
		Name        string `json:"name"`
		ClusterInfo struct {
			Region struct {
				DNS string `json:"dns"`

View on GitHub (pinned to 5069bf80b0)

Solutions

Check query-service logs for the wrapped %w cause (DB error) emitted alongside this message
Verify DB connectivity and that service account migrations ran
Confirm the org exists and the orgId passed is valid
Retry the request after fixing the underlying cause; GetOrCreate is idempotent

Defensive patterns

Strategy: retry

Try / catch

Capture the *basemodel.ApiError, check Typ == model.ErrorInternal, and surface the wrapped cause; retry idempotently once for transient DB errors.

Prevention

Keep service-account migrations applied before enabling cloud integrations
Monitor DB health alerts for the query-service
Log the wrapped %w cause whenever this internal error appears

When it happens

Trigger: Calling the cloud integrations connection-params endpoint (getOrCreateCloudIntegrationFactorAPIKey -> getOrCreateCloudIntegrationServiceAccount) when the underlying DB insert/select fails: DB down, migration missing the service_accounts table, unique-constraint conflict on the integration account, or an invalid orgId.

Common situations: Misconfigured SIGNOZ_SERVICEACCOUNT_EMAIL_DOMAIN, pending/corrupt migrations, transient DB outage, or a partially-created service account left from a previous failed attempt.

Related errors

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/3042c1b6f1b82eef. Report an issue: GitHub.