{"record":{"id":"10b5f57e27af7ffb","repo":"cloudflare/cloudflared","slug":"rest-request-failed-10b5f5","errorCode":null,"errorMessage":"REST request failed","messagePattern":"REST request failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cfapi/tunnel.go","lineNumber":106,"sourceCode":"func (cp CleanupParams) encode() string {\n\treturn cp.queryParams.Encode()\n}\n\nfunc (r *RESTClient) CreateTunnel(name string, tunnelSecret []byte) (*TunnelWithToken, error) {\n\tif name == \"\" {\n\t\treturn nil, errors.New(\"tunnel name required\")\n\t}\n\tif _, err := uuid.Parse(name); err == nil {\n\t\treturn nil, errors.New(\"you cannot use UUIDs as tunnel names\")\n\t}\n\tbody := &newTunnel{\n\t\tName:         name,\n\t\tTunnelSecret: tunnelSecret,\n\t}\n\n\tresp, err := r.sendRequest(\"POST\", r.baseEndpoints.accountLevel, body)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"REST request failed\")\n\t}\n\tdefer resp.Body.Close()\n\n\tswitch resp.StatusCode {\n\tcase http.StatusOK:\n\t\tvar tunnel TunnelWithToken\n\t\tif serdeErr := parseResponse(resp.Body, &tunnel); serdeErr != nil {\n\t\t\treturn nil, serdeErr\n\t\t}\n\t\treturn &tunnel, nil\n\tcase http.StatusConflict:\n\t\treturn nil, ErrTunnelNameConflict\n\t}\n\n\treturn nil, r.statusCodeToError(\"create tunnel\", resp)\n}\n\nfunc (r *RESTClient) GetTunnel(tunnelID uuid.UUID) (*Tunnel, error) {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cfapi/tunnel.go#L88-L124","documentation":"This error wraps a transport-level failure in RESTClient.CreateTunnel (cfapi/tunnel.go:106). The POST to the accountLevel tunnelstore endpoint failed inside r.sendRequest — meaning http.Client.Do returned an error (DNS failure, connection refused/reset, TLS problem, timeout, or a JSON serialization failure of the request body is handled separately, so this is network-level). The tunnel was not created; the API never returned a response.","triggerScenarios":"Calling CreateTunnel when the HTTP POST cannot complete: no connectivity to the Cloudflare API host, proxy/firewall blocking, TLS interception with untrusted certs, request timeout on slow networks, or an invalid base endpoint URL passed to NewRESTClient.","commonSituations":"CI runners without egress to api.cloudflare.com; corporate proxies requiring HTTPS_PROXY; offline local development; misconfigured endpoint override in tests; long request timing out due to defaultTimeout on saturated links.","solutions":["Verify connectivity to the API host (curl -v https://api.cloudflare.com) and resolve network/proxy/firewall problems","Check the wrapped cause inside the error for the concrete net/http reason (timeout vs refused vs TLS)","Set/fix HTTPS_PROXY if behind a corporate proxy; ensure its CA is trusted","Retry with exponential backoff for transient failures; check api.cloudflare.com status for incidents"],"exampleFix":"// before\ntunnel, err := client.CreateTunnel(name, secret)\nif err != nil { return err }\n// after\ntunnel, err := client.CreateTunnel(name, secret)\nif err != nil {\n    log.Warn().Err(err).Msg(\"create tunnel request failed, retrying\")\n    return retryWithBackoff(3, func() error { _, err = client.CreateTunnel(name, secret); return err })\n}","handlingStrategy":"retry","validationCode":"// Go: preflight reachability + non-empty inputs before CreateTunnel\nfunc preflight(host, name string, secret []byte) error {\n    if name == \"\" || len(secret) == 0 { return errors.New(\"name and secret required\") }\n    conn, err := net.DialTimeout(\"tcp\", host+\":443\", 5*time.Second)\n    if err != nil { return err }\n    _ = conn.Close()\n    return nil\n}","typeGuard":"func isTransportError(err error) bool {\n    var netErr net.Error\n    return errors.As(err, &netErr) || errors.As(err, new(*net.OpError))\n}","tryCatchPattern":"tunnel, err := client.CreateTunnel(name, secret)\nif err != nil && isTransportError(err) {\n    return retryWithBackoff(3, 2*time.Second, func() error {\n        tunnel, err = client.CreateTunnel(name, secret)\n        return err\n    })\n}","preventionTips":["Run a connectivity preflight (TCP/TLS to api.cloudflare.com) before tunnel provisioning in CI","Configure proxy/CA settings correctly in restricted networks","Use idempotent retry with backoff since failures may be transient","Check https://www.cloudflarestatus.com during incidents instead of hammering the API"],"tags":["network","http","rest-client","cloudflared"],"backgroundTag":"http-request-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}