{"record":{"id":"0bf7b98754c8c855","repo":"cilium/cilium","slug":"patchendpointidlabelsnotfoundcode","errorCode":"PatchEndpointIDLabelsNotFoundCode","errorMessage":"Endpoint ID %s not found","messagePattern":"Endpoint ID (.+?) not found","errorType":"http","errorClass":null,"httpStatus":404,"severity":"warning","filePath":"pkg/endpoint/api/endpoint_api_manager.go","lineNumber":535,"sourceCode":"// The `add` labels take precedence over `del` labels, this means if the same\n// label is set on both `add` and `del`, that specific label will exist in the\n// endpoint's labels.\n// Returns an HTTP response code and an error msg (or nil on success).\nfunc (m *endpointAPIManager) ModifyEndpointIdentityLabelsFromAPI(id string, add, del labels.Labels) (int, error) {\n\taddLabels, _ := labelsfilter.Filter(add)\n\tdelLabels, _ := labelsfilter.Filter(del)\n\tif lbls := addLabels.FindReserved(); lbls != nil {\n\t\treturn PatchEndpointIDLabelsUpdateFailedCode, fmt.Errorf(\"Not allowed to add reserved labels: %s\", lbls)\n\t} else if lbls := delLabels.FindReserved(); lbls != nil {\n\t\treturn PatchEndpointIDLabelsUpdateFailedCode, fmt.Errorf(\"Not allowed to delete reserved labels: %s\", lbls)\n\t}\n\n\tep, err := m.endpointManager.Lookup(id)\n\tif err != nil {\n\t\treturn PatchEndpointIDInvalidCode, err\n\t}\n\tif ep == nil {\n\t\treturn PatchEndpointIDLabelsNotFoundCode, fmt.Errorf(\"Endpoint ID %s not found\", id)\n\t}\n\tif err = endpoint.APICanModify(ep); err != nil {\n\t\treturn PatchEndpointIDInvalidCode, err\n\t}\n\n\tif err := ep.ModifyIdentityLabels(labels.LabelSourceAny, addLabels, delLabels, 0); err != nil {\n\t\treturn PatchEndpointIDLabelsNotFoundCode, err\n\t}\n\n\treturn PatchEndpointIDLabelsOKCode, nil\n}\n","sourceCodeStart":517,"sourceCodeEnd":547,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/endpoint/api/endpoint_api_manager.go#L517-L547","documentation":"Returned by ModifyEndpointIdentityLabelsFromAPI when the endpoint manager's Lookup(id) finds no endpoint for the given ID (returns nil,nil). The API distinguishes 'not found' (this error, PatchEndpointIDLabelsNotFoundCode) from an invalid/malformed ID (PatchEndpointIDInvalidCode). It means the endpoint has been deleted or never existed on this node.","triggerScenarios":"A PATCH /endpoints/{id}/labels API call with an endpoint ID that does not exist locally, e.g. after the endpoint was deleted, the agent restarted with empty state, or the ID belongs to a different node.","commonSituations":"Race between a client caching endpoint IDs and Cilium deleting/regenerating the endpoint; querying the wrong agent (endpoint is on another node); stale automation scripts referencing old IDs after a Cilium restart.","solutions":["Re-fetch the endpoint list (GET /endpoints) and confirm the ID exists before patching","Treat the 404-style response code as expected: delete/recreate the endpoint or re-derive its ID","Verify you are calling the agent running on the node hosting the endpoint","Check agent logs for endpoint deletion around the time of the call"],"exampleFix":"// before\ncli.EndpointPatchLabels(ctx, \"1234\", add, del) // stale ID\n// after\neps, _ := cli.EndpointList(ctx)\nfor _, ep := range eps {\n    if ep.ID == targetID {\n        cli.EndpointPatchLabels(ctx, targetID, add, del)\n    }\n}","handlingStrategy":"validation","validationCode":"eps, err := client.EndpointList(ctx)\nif err != nil { return err }\nfound := false\nfor _, ep := range eps {\n    if strconv.FormatInt(int64(ep.ID), 10) == id { found = true; break }\n}\nif !found { return fmt.Errorf(\"endpoint %s not present on this agent\", id) }","typeGuard":null,"tryCatchPattern":"err := m.ModifyEndpointIdentityLabelsFromAPI(ctx, id, add, del)\nvar apiErr *api.Error\nif errors.As(err, &apiErr) && apiErr.Code == PatchEndpointIDLabelsNotFoundCode {\n    // refresh endpoint ID and retry once\n}","preventionTips":["Re-fetch endpoint IDs from GET /endpoints instead of caching them across calls","Pin API calls to the agent node hosting the endpoint","Handle the not-found code idempotently in automation","Check agent restart/deletion logs before assuming a bug"],"tags":["cilium","api","endpoint","not-found"],"backgroundTag":"endpoint-not-found","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}